5 ms·

>wget http://shortfin.io/install.sh http://shortfin.io/install.sh && sh install.sh Isn't it recommended that any project doing one-line installs use HTTPS?

• chc 13y ago
  In the same way that it's recommended for any other program, yes.
• bru 13y ago
  Side-note for the author: the download can be made more elegant that way $ curl http://shortfin.io/install.sh | sh I definitely agree with the HTTPS. For example this is what meteor proposes: $ curl https://install.meteor.com | sh
  • pnathan 13y ago
    asdfsdfgkjlsdfg! Streaming your install script directly into computer execution without even giving it a once-over, md5 compare, etc is atrociously insecure.
    • nmcfarl 13y ago
      This seems to be a common complaint but I can't see any reason you can't give it a once over when it's hosted on the web…
    • chc 13y ago
      That's completely orthogonal to what we're talking about here. If you're already not doing it, you're not doing it any less by being more efficient. And it doesn't really matter if you're running it in a throwaway VM like I do.
    • jgreen10 13y ago
      curl https://install.meteor.com | less
• sehrope 13y ago
  ... and especially not if you're suggesting run it as root. You should never run anything as root unless you know what it is. Having it over HTTP vs HTTPS makes things really bad though.