3 ms·
> Is it really that hard to ask people to download and run the script themselves? Why? Isn't that exactly what "curl get.docker.io | sh -x" does? It's the cli
by patrickaljord 13y ago
> Is it really that hard to ask people to download and run the script themselves?
Why? Isn't that exactly what "curl get.docker.io | sh -x" does? It's the cli equivalent to clicking on a download link and then executing it. I think what you mean is "wouldn't it be better for the user to first read the script's code before executing it or run it in a VM?"
- fhars 13y agoNo, with the "curl get.docker.io | sh -x" you have absolutely no reproducability or accountability, as there is way to find out which code was actually run during installation. This is the dream situation for attackers that managed to trojan the install script or MITM the connection (note that the curl call does not even use https) to target specific users.