4 ms·
I mean, it like dodgy to any user familiar with URLs surely? Wouldn't wget -qO - www.example.com/script | sh catch far more of the uninitiated?
by pbhjpbhj 4y ago
I mean, it like dodgy to any user familiar with URLs surely?
Wouldn't
wget -qO - www.example.com/script | sh
catch far more of the uninitiated?
- Spivak 4y agoPeople go nuts about curl | bash but then grab random packages off pip/gem/npm/brew/VimPlug/packages.el/VS Code without so much as a second look and they can all run arbitrary code too.
- skulk 4y agoIf you curl | bash from http, you may get MITM'd because you're not checking the checksum. Most modern package managers at least check that what was downloaded is indeed what the original developer intended, so it's slightly better.