4 ms·

At least it's https; I've seen sites on HN recently[1] that suggest you run code pulled over plain http, as if that wasn't an even more horrible security risk t

At least it's https; I've seen sites on HN recently[1] that suggest you run code pulled over plain http, as if that wasn't an even more horrible security risk than just blindly running a script from the Internet. [1] http://chocolatey.org/ http://chocolatey.org/

TazeTSchnitzel 14y ago
@powershell -NoProfile -ExecutionPolicy unrestricted -Command "iex ((new-object net.webclient).DownloadString('http://chocolatey.org/install.ps1'))" && SET PATH=%PATH%;%systemdrive%\chocolatey\bin Goodness, that looks awful.
- orionblastar 14y ago
  Heh the least they could do is put that into a batch file to be downloaded and clicked on to run. Chocolatey is sort of like an alternative apt-get for Windows, except that it doesn't need s sudo command and your password to install software. It uses cinst to install stuff: cinst firefox Installs Firefox. The UAC asks the current user to allow the setup program to run and that is about it. No password needed to install like apt-get has. Oh yeah if your PC doesn't have Powershell installed you are SOL if you try to use that command to install Chocolatey. Some administrators remove it because it can be used to install software without being known to the user.
  - serge2k 14y ago
    Right, because UAC assumes someone who is logged in as an admin is supposed to be. I configure sudo like this on some of my dev machines, easier and I don't care about them (usually just VMs). Why not just restrict the execution policy? I don't really know PS thta well, but doesn't that stop arbitrary (or any) scripts?
    - orionblastar 14y ago
      You are revealing the security flaws of Windows. Cancel or Allow?