>The problem is that there's a lot of software out there that expects you to install it this way - particularly by piping into sh or bash or the like.

The real problem is that this is nothing different than trusting a binary download -- which many more millions (billions) do.

Or, for that matter, a source download. Or one you've hashed (how do you know the hash hasn't been tampered with?), a microprocessor (have you looked at the microcode? the masks), a circuit, etc.

Turtles^H^H^H^H^H^H^HTrust all the way down.

I'm not being entirely facetious, either, given the advice about disposing of electronics after visiting certain countries.

On one hand, I'm glad people are working on easier ways to install software. On the other, everyone is ignoring distro package managers.

Docker gets it right [1] and then gets it wrong [2] - depends which set of instructions you read.

I know creating distro packages and self-hosted repos is difficult, maybe we should be attacking that as a problem instead of writing hundreds of different shell scripts.

1: https://docs.docker.com/engine/installation/ubuntulinux/

2: https://docs.docker.com/v1.8/installation/ubuntulinux/#insta...

Bonus: https://twitter.com/mjg59/status/655812609715769349

I ran into this for the first time just recently when installing ruby and was very surprised and hesitant to follow the instructions ( see here https://www.digitalocean.com/community/tutorials/how-to-inst... ). Glad to see people speaking out against it.

One example: http://curlpipesh.tumblr.com/

That was the blog I was looking for. Thanks.

Luckily both can be installed almost as easily without the curl pipe hack... Not sure why so many projects want to reduce install steps from three to one with a shell script. I could understand if you have 90 steps (in which case I would recommend you figure out a better install process in general), but not for simple 'download something, move it to a path, run a command, and you're done'. See my roles for both of the packages you mentioned above on Ansible Galaxy for more info; I tend to avoid doing the curl pipes for sanity even more so than security.

I want to know what I'm doing with my server when I'm installing packages or other software!

Also the ever popular Docker.

On the other hand, if it's over SSL, you're just as well off as installing the software any other way. Although, I noticed the Drupal console installer isn't even on SSL.

None of those commands are so long that you shouldn't just be retyping them by hand. It's obviously not an ideal way to install anything, but it's much safer than copy and pasting.

or copy them to a text editor first?

Is that safe? (Legitimate question)

one can target specific editors...

for instance, if I know you are using VI I can create a series of characters that will escape out of insert mode and run a shell command (note: ^[ is ESC (ascii 27))

git status

^[

:!echo foo

If you don't know what it will do. Don't do it. Don't hide behind "I need this and this is how to install it". know what's going on or don't do it.