4 ms·
Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD
by geofft 5y ago
Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD/USB image and booting it up "bad practice."
You have to trust the place where you're downloading it from, of course. But there's nothing inherently worse about /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)" than burning https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/de... and booting it up.
- sethammons 5y agoYou can actually detect from the server side if curl is being piped and dynamically change the payload.
- geofft 5y agoYes! I'm not sure how that changes what I'm saying. If you don't trust the server, it can give you a malicious ISO, too. Or are you saying that you audit the bits of the ISO yourself before burning it?
- throwaway2037 5y agoWoah. How? Assume scrubber request headers.
- namibj 5y agolatency/buffer size/stalling effects. It's the difference between `curl evil.com/installer.sh | sh` and `curl evil.com/installer.sh | cat > installer.sh`.
- bombela 5y agoWhy the downvotes on the parent? It's literally the same thing: running random code from the internet on your computer!