3 ms·

So you don't bother to read the source before running when it's open? How is that any different from running npm which is even harder to audit with many depend

So you don't bother to read the source before running when it's open? How is that any different from running npm which is even harder to audit with many dependencies? OS packages may have maintainers and some eyes before being packaged but for other ecosystems where people can just upload, it seems it's on the same level.

deadbunny 4y ago
There are known attacks that can detect if your curling into bash vs. just curling/downloading which can change the script being delivered[1]. So yeah read it all you want, just don't curl it and pipe it to bash. 1. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...