4 ms·

I can't be the only person who hates install instructions like 'curl -L some.host|bash'. Not to mention that the yeoman install script happily installs homebrew

• mgallivan 14y ago
  What do you prefer?
• sp4rki 14y ago
  If you don't trust such methods of installation, you don't have to use them. Also, you can always look at the source of the script if you don't trust said method and choose for if you want to install by hand, use the script, or just don't use the tool at all. You really can't fault Yeoman because they want to make it easy and painless to install their tool. For the people that want to check out the script: https://raw.github.com/yeoman/yeoman/master/setup/install.sh https://raw.github.com/yeoman/yeoman/master/setup/install.sh
• cleverjake 14y ago
  I honestly like it. I can actually read the source, as opposed to a pkg or or .app. Do you think piping a shell script is less secure?
• burke 14y ago
  Why? It's no different from any other installation method: http://gist.io/3670086 http://gist.io/3670086 You're running code you haven't read. It all reduces to exactly the same vulnerability.
• oh_sigh 14y ago
  Why? I completely understand the intent of "curl -L some.host|bash". Even if I don't have curl or bash, I immediately know what is happening. It's obviously a concern that you are downloading unchecked code from the internet and running it on your computer, but if you are talented enough to be able to inspect the code and certify it is not malicious, you are also talented enough how to get the code without executing it.