3 ms·
Ask HN: Alternative to curl https://install.foo.com | /bin/sh?
It's well known that curling a script from the internet and executing it directly like so,
curl https://install.foo.com | /bin/sh
seems to be frowned upon [0][1] for security reasons[2][3]. However, it's an incredibly effective way to help bootstrap a development environment. What are the best approaches to achieving the same goal without going through lots of the trouble with creating packages for every target system out there?
[0] https://news.ycombinator.com/item?id=4701745
[1] https://news.ycombinator.com/item?id=6008196
[2] http://blog.classicalcode.com/2012/11/curl-pipe-sh-exploit-proof-of-concept/
[3] https://news.ycombinator.com/item?id=3315461
real examples in the wild:
ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go)"
curl https://install.meteor.com | /bin/sh
bash < <(curl -s https://rvm.io/install/rvm)
curl get.pow.cx | sh
curl -sS https://getcomposer.org/installer | php
- kjs3 13y agoIf you're bootstrapping an environment you created, checksum the download and verify the checksum before feeding it to the "unpacker". Another thought would be to mutually authenticate the SSL session. The curl man page has good doco as to how to do this. It does involve mucking around with PKCS12 key material, but it's not bad. Best...do both.