3 ms·
To be fair, the instructions on https://swift.org/download/#using-downloads https://swift.org/download/#using-downloads are fairly straightforward and copy-past
by eecc 5y ago
To be fair, the instructions on https://swift.org/download/#using-downloads https://swift.org/download/#using-downloads are fairly straightforward and copy-pastable.
Indeed the prominence given to pgp signature verification is a breath of fresh air compared to the current wave of pipe-shell intros: it's not gatekeeping to ask a would-be programmer to exercise some reading skills and internalize the idea of signature verification.
:)
- iudqnolq 5y agoWhat's the point of signature verification if you get the signature and the binary from the same server? I appreciate the lack of pretenses of `curl | sudo bash`.
- eecc 5y agoWell, an attacker would need to first steal the private keys before they could generate the forged signatures. So, while you could still change the public keys in the instructions and trick first-comers to install a back-doored archive, you'd still be caught in a heartbeat by everyone else who already trusted the legitimate keys (which are published via a keyserver.) The chances and rewards of a successful, long-lasting attack are pretty slim, especially compared to those against other curl-bang installers (brew, oh-my-zsh...)
- GoOnThenDoTell 5y agoIt kinda implies that no one writes Unix tools in swift, otherwise it would already be packaged in the disto of your choice
- Redoubts 5y agoYeah though I can see people not wanting to deploy a fat runtime just to run some cli tools.
- herbst 5y agoBeing able to install something is only half of the issue. I wouldnt touch a language for production where i have to setup my environment myself completely without package control.