3 ms·
`curl | sh` is perfectly fine and not any more dangerous than using apt or whatever else.
by insanitybit 4y ago
`curl | sh` is perfectly fine and not any more dangerous than using apt or whatever else.
- stouset 4y agoIt's not quite as safe, since with apt or rpm the package can be signed by the distribution a (presumably) safer system, instead of being signed on-the-fly by an outward-facing webserver. But it's still pretty damn safe.
- 0x457 4y agoAnd `curl | sh` is signed by a certificate issued by CA. It's the same amount of safety if not more, since there is a trusted 3rd party while package managers are "trust me bro, it's our public key" Anyways, I'm not using rustup and using my nix flake to handle everything for me.
- craftkiller 4y agoThose files you get from `curl | sh` are just whatever happens to be on their internet-facing server (or any CDN server) at the time, whereas signing the actual package instead of the tls certificate for the https connection means that package building and signing could have been done entirely on a secure/isolated machine. Using `curl | sh` you're rolling the dice that the web-facing server didn't get pwned. Using signed packages means you don't care if the web-facing server got pwned.
- chlorion 4y ago`curl | sh` is not signed by a CA. With a conventional package manager, the contents of the package itself is signed, not just the connection to the mirror that hosts the package itself. Having a secure connection to the mirror is not necessary in this case because there is no way to modify the package without it being detected. With `curl | sh`, only the connection to the server is signed, but not what you are piping into your shell.
- insanitybit 4y agoMeh. I'm gonna say it's just as safe.
- stouset 4y agoI was certainly picking at a very, very tiny nit.
- superkuh 4y agoUntil the javascript, or unicode characters, or whatever hide the actual shell script URL/exploit/newline/etc copied and you paste it blindly.
- insanitybit 4y agoStill just as safe.