4 ms·
It can be doing anything your shell is privileged to do. You’re effectively giving password-less ssh to the Internet.
by mulmen 4y ago
It can be doing anything your shell is privileged to do. You’re effectively giving password-less ssh to the Internet.
- tasuki 4y agoI think the point that sebzim4500 was making is that the script is downloading an arbitrary binary and running it and that this isn't any less dangerous than running an arbitrary script, so you're screwer either way. If someone wanted to do `rm -rf /` on your system, they wouldn't put it in the setup script you're piping to sh: they'd put it into the binary, making your inspection of the setup script effectively useless.
- mulmen 4y agoIf an installation script is downloading an arbitrary binary then I’m not running that script unless that binary also comes from a trusted source. We have PKI to prove that sites are who they claim to be. I only run binaries from trusted sources.
- tasuki 4y agoBut then if you trust that source and its binaries, why would you inspect their scripts? What extra protection does that give you? None, imo.
- School-Cotton 4y agoHow is that different from downloading a binary from the internet and running it?
- mulmen 4y agoKnowledge and trust of the source.