4 ms·
The problem isn't pipe, it's the default to blind trust.People will happily audit a PR but won't spend 5 seconds reading a script they're about to run as root.
by late_night_fix 5mo ago
The problem isn't pipe, it's the default to blind trust.People will happily audit a PR but won't spend 5 seconds reading a script they're about to run as root.
- halJordan 5mo agoIt's not trust. There are plenty of major projects that only have or strongly prefer curl | bash. Trusting a vendor is fine.