2 ms·
Why is this discussion always happening when we talk about downloading and executing scripts when otoh, nobody bats an eye when you need to download and execute
by pjerem 4y ago
Why is this discussion always happening when we talk about downloading and executing scripts when otoh, nobody bats an eye when you need to download and execute some binary ?
I'm not saying that you should trust anything coming from anywhere, but you have no other choice than to trust the author of any software you run on your computer.
Even if the Chezmoi's author was a malicious guy, why would he hide something in the installation script when this script literally permanently installs a program on your computer.
- doubled112 4y agoI'm more answering the question than agreeing with the answer. Trust seems like such an arbitrary set of lines in the sand anyway. Adding a repo to your OS and installing the package? Fine. Same developer provides an install script? Absolutely not. You have to trust somebody eventually, whether it be your HW manufacturer, OS developers, packagers, developers, etc. There's a lot of it blindly going on, but a script running as your user? Just can't.