4 ms·
I do not want to be that guy, but I do anyway. Haha. Is there time for a service that looks at any README on a github project or other indexable repos, and gi
by 616c 12y ago
I do not want to be that guy, but I do anyway. Haha.
Is there time for a service that looks at any README on a github project or other indexable repos, and give it a cute landing page and failing grade if the install recommends curl http://supersecure.script http://supersecure.script - | bash # fuck my box.
Perhaps ismyboxvaklem.pt?
- kolev 12y agoThat's funny, but I think the idea of bpkg is to be the last tool you'd have to install the failing-grade way and use bpkg for any future tools on various platforms and all.
- zeograd 12y agotechnically, they don't recommend it. curl whatever | bash is one of the 3 possible method (first listed, I agree) but there are 2 other ways to install it. otoh, don't you think that without the unsecure one liner to install it, some people would complain about its lack ? Stating they can read the script before executing it anyway. Plus, it's not much less secure than cloning a repo and running 'make install' (in both case, one could read the script(s) but will unlikely do so).
- kolev 12y agoExactly my thoughs, too! When you clone and make blindly, it's not any safer.
- vezzy-fnord 12y agoObligatory mention: http://russianroulette.sh http://russianroulette.sh As a warning, it actually is dangerous to run, but it conveys the point succinctly.
- chongli 12y agoHow is this any different from?: $ curl http://supersecure.script -O foo.sh $ bash foo.sh
- rottingchris 12y agoThe connection can break mid-download leaving you with a partially executed script.