4 ms·
Good thing we haven't normalized installing things with curl | sh
by ryandrake 6mo ago
Good thing we haven't normalized installing things with curl | sh
- dawnerd 6mo agoOr npm being allowed to run arbitrary post install scripts
- Semaphor 6mo agoI don’t think that matters as it’s usually curl | sudo sh
- FlyThruTheSun 6mo agoI literally ship an installer that runs with curl | bash... reading this thread while patching my servers is a fun experience lol
- still_grokking 6mo agoYeah, that's great! Imagine we would download random code from the internet and just execute it, like with NPM, PIP, Maven, Cargo etc.
- om8 6mo agocargo/uv/go have lock files though
- dnnddidiej 6mo agowith curl | sh you could use a checksum you download with curl!