3 ms·
It's no different from steps 2 and 3. At each step you're trusting that code you just downloaded from the web is doing what you want it to do.
by brlewis 12y ago
It's no different from steps 2 and 3. At each step you're trusting that code you just downloaded from the web is doing what you want it to do.
- lukeschlather 12y agoYou're also trusting that the Internet is going to stay up for the duration of the install script, which is an unreliable assumption. Imagine at some point the script does: rm -rf ~/.config/google and the connection gives out at rm -rf ~/ Suddenly your script didn't install, and you've blown away your home directory. HTTP(S) is designed for reading documents, where it's OK if you can't read the document in its entirety.
- delroth 12y agoThis is easily solved by putting everything in a bash function and calling the function as the last thing in the script. If you look at the Cloud SDK setup script, that is exactly what it does.
- lukeschlather 12y agoI agree it's a trivial problem to solve, I just think the right way is to download the code and store it separately, so that it's easy to add checksum/signature validation later.