News for hackers. Stuff that matters.

A comment on A system for signed installers to replace curl | sh.

Re:A system for signed installers to replace curl | sh by smt88 on Saturday January 23, 2016 @11:08AM (#10958771)
This seems to make downloading scripts safer when encryption isn't supported by the server. Is that true, or am I way off base?

(For those reading who are incredulous that a reasonable person would ask you to download an installation script over unencrypted HTTP, you are right to be incredulous. Even some large-ish companies do it. It's insane.)

[ Parent | on HN ]
Re:A system for signed installers to replace curl | sh by gemma on Saturday January 23, 2016 @04:28PM (#10960183)
Yup. It adds an extra identity verification layer, whether your script is served over SSL or not.
[ Parent | on HN ]