3 ms·
Yeah, the curl|bash approach is approximately as safe as basically any other software installation method, if you trust the owner of the URL as much as you trus
by fiddlerwoaroof 3y ago
Yeah, the curl|bash approach is approximately as safe as basically any other software installation method, if you trust the owner of the URL as much as you trust the maintainers of NPM, Pypi, etc.
- robertlagrant 3y agoThe maintainers of those are not checking packages. You have to inspect the source code to check what it's doing. Same as a script you curl.
- fiddlerwoaroof 3y agoPackage registry maintainers do often do some things that make it a bit safer than just using things from a random person online: e.g. preventing someone from deleting a popular package, which would enable various sorts of squatting attacks. But, you’re generally right.