4 ms·

Yes, really. Also really "brew install X". Also really download some binary and run it. Do you inspect every line of the source code of the every app you run

• viccuad 11y ago
  well, there's a jump from make install/wgetting/brew install and just trusting your distro's repo (eg: Debian).
• yellowapple 11y ago
  You're missing my point. Piping wget/curl into sh is notoriously dangerous not because of security concerns, but because of the behavior of sh if it only receives a partial script that way (such as would be the case if curl or wget are interrupted for whatever reason, particularly in the event of a network failure mid-download). At least with a package manager like Homebrew or apt-get it'll wait for the download to actually finish before trying to install something (at least on a per-package basis; few package managers actually wait for all packages and their dependencies to be downloaded before installing any of them). Just because trendy hip tools like brew and RVM encourage this behavior doesn't mean it's actually a good idea.