3 ms·
I feel better with `curl ... | sh` than with npm. npm suggests projects written in js, which is not something I'm comfortable. It is nice to see that this is
by krzyk 7mo ago
I feel better with `curl ... | sh` than with npm.
npm suggests projects written in js, which is not something I'm comfortable.
It is nice to see that this is not JS, but Rust.
- varenc 7mo agoAgreed! The `curl ... | sh` is sketchy, but it's more obviously a security risk and easier to inspect. With install hooks, `npm install ...` also allows arbitrary code execution when you run it, but this is less obvious.