4 ms·
What's the security difference between running a compiled application from a site vs running curl|bash with a script hosted on the same site?
by chowells 3y ago
What's the security difference between running a compiled application from a site vs running curl|bash with a script hosted on the same site?
- fiddlerwoaroof 3y agoYeah, the curl|bash approach is approximately as safe as basically any other software installation method, if you trust the owner of the URL as much as you trust the maintainers of NPM, Pypi, etc.
- robertlagrant 3y agoThe maintainers of those are not checking packages. You have to inspect the source code to check what it's doing. Same as a script you curl.
- fiddlerwoaroof 3y agoPackage registry maintainers do often do some things that make it a bit safer than just using things from a random person online: e.g. preventing someone from deleting a popular package, which would enable various sorts of squatting attacks. But, you’re generally right.
- JohnMakin 3y agoyou are at the mercy of whatever that link decides to resolve to, which makes it vulnerable to squatting, cache poisoning attacks, etc.
- gruez 3y agoAs opposed to other forms of download method?