3 ms·
I thought we, as an industry, had all agreed that `curl https://bun.sh/install https://bun.sh/install | bash` was something we should never do and never encoura
by jkubicek 3y ago
I thought we, as an industry, had all agreed that `curl https://bun.sh/install https://bun.sh/install | bash` was something we should never do and never encourage.
- fkyoureadthedoc 3y agoIf you don't trust bun.sh don't do it. They would be torpedoing their project if they put something nefarious in there though, and it would probably more effective to put the nefarious stuff in bun directly. Yes a 3rd party could have gained access to their site and modified that script, but that's covered under "trust bun.sh".
- williamstein 3y agoIt's also a short, clean and easy to read shell script.
- mekster 3y agoIf you can't trust that, then I suppose you're checking every node_modules dir for any malicious codes but I guess you're just being allergic to pipe bash.
- nonethewiser 3y agoCan you walk us through an alternative and why it would be safer?
- pxeger1 3y agoI don't like `curl|bash` not because it's insecure but because I don't know what it's doing to my system, and I don't believe that it understands my system properly. Ideally I'd download a single binary and put it in /usr/local/bin myself.
- Rapzid 3y agoYou have it backwards. Even Microsoft posts install scripts such as this for DotNet.