3 ms·

I've made a list here: http://curlpipesh.tumblr.com/ http://curlpipesh.tumblr.com/

• yourad_io 12y ago
  My personal beef is with curling HTTP (no -s) URLs - getting an installation shell script over HTTPS is not unreasonable (unless instructed to provide a no-SSL-confirmation flag, such as -k for curl, in which case it is more or less the same thing). By default, `curl https://blah.blah/` https://blah.blah/` will only work if the TLS certs are proper & validated. This isn't about trusting the author (you'll be running their code anyway, one way or another) but the transport medium (HTTP!s). If I had your show-and-shame tumblr, I'd only include http:// http:// links.
• zxcdw 12y ago
  Please add the case of Rust package manager Cargo, found at http://crates.io http://crates.io
  • emillon 12y ago
    Done. Thanks!
• yonran 12y ago
  The vast majority of your weblog postings describe https downloads, so it is mostly tangential to grandparent’s complaint and to the article. A .sh script may be a messier and less idiomatic file format than .pkg/.deb/.rpm/.msi, but a pkg from an unknown server is just as dangerous as a shell script from an unknown server.
  • deleted 12y ago
    [deleted]