3 ms·
No one in their right mind would install software using `curl | bash`
by badcafe23423435 2mo ago
No one in their right mind would install software using `curl | bash`
- schaefer 2mo agoI feel the same, which is why I only use these tools in a docker container. Because life is compromise.
- redeeman 2mo agoits a good way to check if people are insane though. would be a cool tactic for new hire evaluation, monitor them setting up dev environment. do the curl | bash, and its instafail
- chrisweekly 2mo agoIn countless corporate environments (including in highly regulated industries), far from being a firable offense, piping curl to bash is often a prescribed step in setting up the standard dev env. The cognitive dissonance is soul crushing. Maybe they're testing for one's ability to tolerate it.
- cjbprime 2mo agoWhy not? The web uses TLS, how's it different security-wise compared to a package download?
- bityard 2mo agoIt's less about malicious intent and more about predictability. When I install software on my computer with apt, I trust that all the files will go to the right place and install scripts are going to do sane things relative to the rest of the system. And I can just uninstall the whole thing with one command later if I so choose. If I curlpipe a script, I get none of those guarantees. I have seen curlpipes that put files in weird places, guess the wrong OS, and mess with config files that I didn't want them to touch. When they break or I want to uninstall, I have to sit down and understand a (possibly minified) script to clean things up manually. Yes containers are a half solution to this, no I don't want to use containers 100% of the time.