Detecting the use of “curl – bash” server side

Re:Detecting the use of “curl – bash” server side by lgessler on Wednesday April 20, 2016 @08:13AM (#11533777)

FWIW, this is Meteor's justification in /usr/local/bin/meteor:

    # This is the script that we install somewhere in your $PATH (as "meteor")
    # when you run
    #   $ curl https://install.meteor.com/ | sh
    # It's the only file that we install globally on your system; each user of
    # Meteor gets their own personal package and tools repository, called the
    # warehouse (or, for 0.9.0 and newer, the "tropohouse"), in ~/.meteor/. This
    # means that a user can share packages among multiple apps and automatically
    # update to new releases without having to have permissions to write them to
    # anywhere global.

[ Parent | on HN ]

Re:Detecting the use of “curl – bash” server side by TallGuyShort on Wednesday April 20, 2016 @09:43AM (#11534293)

I used to do Linux packaging full-time and constantly hit limitations in what Linux packaging formats support or allow. There's still a lot of progress that could be made in that area, but unfortunately any attempt to improve will likely become that 15th competing standard XKCD refers to...

[ Parent | on HN ]

Re:Detecting the use of “curl – bash” server side by pbhjpbhj on Wednesday April 20, 2016 @05:26PM (#11537867)

They could be in ~/.local/share/meteor following "XDG Base Directory Specification" (https://specifications.freedesktop.org/basedir-spec/basedir-... - seems well used on my Kubuntu but it's a case of "pick a standard" I guess).

[ Parent | on HN ]