3 ms·
On the curl | sh pattern
- dmix 12y agoRVM, pow, heroku, homebrew... all things I had to deal with as a Ruby developer. I was shocked at how often it is recommended when I had to set up a new Ruby dev environment on OSX. Too bad seeing Rust following that trend as well. I was hoping new platforms would evolve past that
- mparramon 12y agoIs there a better platform-independent option?
- beberlei 12y agoIt is not platform independent because it will never work on windows. A two step procedure of 1. picking the OS/distro and 2. the few lines to safely install on that system is hardly more complicated imho. Much safer though
- kibwen 12y agoRust doesn't do it, Cargo does. And it's only doing it until Rust reaches 1.0, by which time there will be a proper bundled Rust+Cargo installer. And it's downloading over HTTPS without disabling the certificate check, which is the least egregious form of this (and frankly, if you can't trust that your TLS sessions aren't being hijacked you have a bigger problem).
- anonfunction 12y agoThis article completely neglects to mention the other dangers of this pattern, namely what happens when the connection drops mid download[1] or the server responds differently based on user-agent or IP[2]. [1] http://www.seancassidy.me/dont-pipe-to-your-shell.html http://www.seancassidy.me/dont-pipe-to-your-shell.html [2] http://www.djm.org.uk/protect-yourself-from-non-obvious-dangers-curl-url-pipe-sh/ http://www.djm.org.uk/protect-yourself-from-non-obvious-dang...
- rmetzler 12y agohttps://get.docker.com/ https://get.docker.com/ does this too. Though I feel like they do a much better job than Adobe, when I download Flash from http and don't know what the installer does.