4 ms·

You didn't even take a look at https://get.docker.io https://get.docker.io It's still downloading and executing a script, just two steps instead of piping the

You didn't even take a look at https://get.docker.io https://get.docker.io It's still downloading and executing a script, just two steps instead of piping the output straight into bash. You can't even inspect the code you run when you do curl|bash and the server is able to detect this distinction and hide code when you do a curl and then run bash. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... Your argument is: "we do it and we use GitHub, you can trust us and can trust GitHub, you don't need to verify the code you run." And devs learn: "Trust me, you don't need to verify the code you run."

kentonv 5y ago
> You didn't even take a look at https://get.docker.io https://get.docker.io You got me. The last time I installed Docker, I remember doing it using packages, so I assumed that was the replacement. Looking at their comment, it looks like they got tired of people arguing about it, so they changed the instructions to sidestep the argument. I don't think they seriously believe this made a security difference. > You can't even inspect the code you run when you do curl|bash and the server is able to detect this distinction and hide code when you do a curl and then run bash. I addressed exactly this argument two comments ago. > Your argument is: "we do it and we use GitHub, you can trust us and can trust GitHub, you don't need to verify the code you run." When did I ever say anything about GitHub? This isn't my argument at all. > And devs learn: "Trust me, you don't need to verify the code you run." Come on, nobody actually verifies all the code they run.