2 ms·

Yeah, from source in that case. Or using a verified binary if I absolutely had to.

• qarl2 4mo ago
  Yes, if you want to, you can do that. Understand that 99% are comfortable trusting downloads. They know that it's just as easy to sneak backdoors into source code as it is to sneak backdoors into executables. See also: XZ hack.
  • tovej 4mo ago
    99% of developers are most definitely not comfortable piping a script into the shell. I would never runa script without reviewing it. I would install a package from a distros repository without reviewing the contents, however, because I can trust that a distro maintainer has reviewed it, that anyone else in the community can review it, and that that the bytes I'm downloading are the specific bytes I'm supposed to be downloading. If you run a script off the open internet, you're being massively irresponsible. There are so many attack vectors that could be used here, and they are much easier to implement than something like the massive social engineering attack that was XZ.
    • qarl2 4mo ago
      As someone who has spent years in the software industry in silicon valley - My experience does not match yours.
      • tovej 4mo ago
        I didn't realize silicon valley was full of software cowboys. Well, I suppose that matches the "move fast and break things" credo. lol.