3 ms·
I don't see how this is less secure than downloading a program and running it. Or downloading some package that asks you to run an install script. People will
by razzaj 12y ago
I don't see how this is less secure than downloading a program and running it. Or downloading some package that asks you to run an install script.
People will see no problem with curl | sh as long as they feel they can trust the source/site asking them to do so. They will be running the same risk as with downloading binaries or install packages.
- Gigablah 12y agoExactly. This is little more than cargo culting.
- andrewchambers 12y agoI'd at least save the script somewhere so i can audit it if something goes wrong after i run it.
- dllthomas 12y agoThe truncation issue is an interesting additional wrinkle, if unlikely. I agree that, aside from that issue, the practice of many people is not materially worse than "curl | sh", but we should condemn that similarly.