3 ms·

Why not? There's plenty of things that are installable that way. For example: RVM: bash < <(curl -s https://raw.github.com/wayneeseguin/rvm/master/binscri

Why not? There's plenty of things that are installable that way. For example: RVM: bash < <(curl -s https://raw.github.com/wayneeseguin/rvm/master/binscripts/rvm-installer ) Homebrew: /usr/bin/ruby -e "$(curl -fsSL https://raw.github.com/gist/323731)"

gvb 15y ago
Because you are installing programs on your computer from a "shortened URL", which could point anywhere. Your examples use a URL that is the final destination so you can make an informed decision whether you are willing to trust that URL. If you use the "append a +" bit.ly feature, you can check where it ends up, but not everybody knows to do that. https://bitly.com/psChocInstall+ https://bitly.com/psChocInstall+
- baddox 15y ago
  A non-shortened URL can point anywhere as well. The only way to "make an informed decision" is to put the URL in your browser—that goes for shortened and non-shortened URLs.
  - pluies 15y ago
    If I were to attack someone with such a scheme, I would take care of serving clean files to a web browser (say, with the user-agent string) and the infected files to command-line invocations. :)
    - baddox 15y ago
      Yes, that's quite a security risk, but it also affects shortened and non-shortened URLs equally.
  - dagw 15y ago
    With a non-shortened URL you have one attack vector, hack the website. With a shortened URL you have two attack vectors, hack the website or hijack the shortened URL to point to your own server.
- ferventcoder 15y ago
  Would providing the full link be a better idea? For the installer experience, people wanted short and memorable.
dekz 15y ago
1) Those links from github are served over https, lets ignore the fact that curl might ignore it though. 2) .com isn't as potentially susceptible as a Libyan tld. 3) They are relying on bit.ly to serve the correct file.
- ferventcoder 15y ago
  Perhaps the full url to the github file would reduce the cryptic url?
burgerbrain 15y ago
IIRC, a few months ago there was quite a large discussion here on HNs about the reason you shouldn't do either of those. Can't find the discussion, but there is certainly a fairly large body of people who oppose those examples as well.

gvb 15y ago

Because you are installing programs on your computer from a "shortened URL", which could point anywhere. Your examples use a URL that is the final destination so you can make an informed decision whether you are willing to trust that URL. If you use the "append a +" bit.ly feature, you can check where it ends up, but not everybody knows to do that. https://bitly.com/psChocInstall+ https://bitly.com/psChocInstall+

baddox 15y ago
A non-shortened URL can point anywhere as well. The only way to "make an informed decision" is to put the URL in your browser—that goes for shortened and non-shortened URLs.
- pluies 15y ago
  If I were to attack someone with such a scheme, I would take care of serving clean files to a web browser (say, with the user-agent string) and the infected files to command-line invocations. :)
  - baddox 15y ago
    Yes, that's quite a security risk, but it also affects shortened and non-shortened URLs equally.
- dagw 15y ago
  With a non-shortened URL you have one attack vector, hack the website. With a shortened URL you have two attack vectors, hack the website or hijack the shortened URL to point to your own server.
ferventcoder 15y ago
Would providing the full link be a better idea? For the installer experience, people wanted short and memorable.

dekz 15y ago

1) Those links from github are served over https, lets ignore the fact that curl might ignore it though. 2) .com isn't as potentially susceptible as a Libyan tld. 3) They are relying on bit.ly to serve the correct file.

ferventcoder 15y ago
Perhaps the full url to the github file would reduce the cryptic url?

burgerbrain 15y ago

IIRC, a few months ago there was quite a large discussion here on HNs about the reason you shouldn't do either of those. Can't find the discussion, but there is certainly a fairly large body of people who oppose those examples as well.