3 ms·
And `curl | sh` is signed by a certificate issued by CA. It's the same amount of safety if not more, since there is a trusted 3rd party while package managers a
by 0x457 4y ago
And `curl | sh` is signed by a certificate issued by CA. It's the same amount of safety if not more, since there is a trusted 3rd party while package managers are "trust me bro, it's our public key"
Anyways, I'm not using rustup and using my nix flake to handle everything for me.
- craftkiller 4y agoThose files you get from `curl | sh` are just whatever happens to be on their internet-facing server (or any CDN server) at the time, whereas signing the actual package instead of the tls certificate for the https connection means that package building and signing could have been done entirely on a secure/isolated machine. Using `curl | sh` you're rolling the dice that the web-facing server didn't get pwned. Using signed packages means you don't care if the web-facing server got pwned.
- chlorion 4y ago`curl | sh` is not signed by a CA. With a conventional package manager, the contents of the package itself is signed, not just the connection to the mirror that hosts the package itself. Having a secure connection to the mirror is not necessary in this case because there is no way to modify the package without it being detected. With `curl | sh`, only the connection to the server is signed, but not what you are piping into your shell.