3 ms·
That is better to me than installing a random binary. You can trivially audit the curl. Also, the curl > bash thing usually comes from the project maintainer (a
by christophilus 3y ago
That is better to me than installing a random binary. You can trivially audit the curl. Also, the curl > bash thing usually comes from the project maintainer (as in the case of Bun) vs some rando flatpacker.
- account42 3y agoNo, you cannot audit the curl at all. What a website serves you now is not neccessarily what the website serves you one minute from now.
- smallerfish 3y agoNot if the bash part then turns around and installs a random binary, which is often the case. How do you know how thoroughly it's been audited by third parties? Does it have a security patch mechanism built into it?
- johnisgood 3y agoIn all fairness, Jia was indeed the co-maintainer of the project. He modified SECURITY.md as well[1]. [1] https://github.com/tukaani-project/xz/commit/780d2c236de0e4749655696c2e0c26fb7565afd3 https://github.com/tukaani-project/xz/commit/780d2c236de0e47...