3 ms·
It gives the installer no more or less privileges than if you were to download and run a binary or double click on an installer script.
by gravitronic 14y ago
It gives the installer no more or less privileges than if you were to download and run a binary or double click on an installer script.
- Jgrubb 14y agoI get that, but what if you recently ran sudo make-me-a-sandwich in that shell session? If someone maliciously slipped a sudo command in that script they'd have everything they needed, and you might not even realize it. Obviously, I'm not suggesting the authors of these tools, but these remote shell installers seem like they'd be obvious targets for Bad Hackers. It seems like the whole point of these remote shell installers is to make it easier for some people, but some might not be aware of this risk.
- gravitronic 14y agoyou know you could just read the shell script, which is one way that this install method is more transparent than an installer binary.
- SkyMarshal 14y agoYes, and they should drop the pipe to bash/sh at the end of the curl command. Download it, read it, then manually run it, don't just pipe it all together.