Bpkg: package manager for bash

Re:Bpkg: package manager for bash by oholiab on Sunday July 03, 2016 @03:57PM (#12027364)

It's actually possible to detect the |bash part server side and send different content than if you were simply curling, wgeting or viewing in a browser.

Not only does this mean that you could end up with a compromised system, but it also means that there's no artefact of what caused it left on disk.

I agree with your point that running third party software is always a risk, the problem here being that you can think you've done your due diligence by reading the curl output first and then doing curl|bash, but in actuality this is not necessarily the case which is what makes curl|bash such an insidious bad habit.

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

[ Parent | on HN ]

Re:Bpkg: package manager for bash by ricardobeat on Sunday July 03, 2016 @04:03PM (#12027389)

Does anyone read install scripts/formulas when installing something from system package managers?

[ Parent | on HN ]

Re:Bpkg: package manager for bash by bluecmd on Sunday July 03, 2016 @05:13PM (#12027651)

No, but I trust my OS distribution. I don't trust random third-party developer. I wouldn't add their APT repository willy nilly either.

[ Parent | on HN ]

Re:Bpkg: package manager for bash by semi-extrinsic on Sunday July 03, 2016 @06:49PM (#12027993)

On Arch, installing from AUR people are told to (and generally will) inspect the install script(s) when installing something. It's part of the workflow for all AUR helpers.

[ Parent | on HN ]