4 ms·
Whoever terminates this http request gets to run arbitrary code on my computer that I haven't read, in the context of my user
by knewter 4y ago
Whoever terminates this http request gets to run arbitrary code on my computer that I haven't read, in the context of my user
- solarkraft 4y agoHow does it differ from running any proprietary software other than that you can read the script before running it?
- jackling 4y agoYou can usually checksum anything you download to ensure it's legit. A script that you curl is unlikely to have such a thing I guess.
- jnwatson 4y agoYou can always read it first. It isn’t much different than pip or apt.
- sergiomattei 4y agoEasy to change the content depending on user agent.
- chrsstrm 4y agoSo curl it but don’t pipe it into shell.
- pgwhalen 4y agoIsn’t that just the nature of installing software period? I suppose perhaps you could read all code you use before installing it, but I expect the number of people who do that rounds down to zero.
- ipaddr 4y agoIf it's open source and in a certain language I always peek. Not necessarily for security but to see how they structured things.