News for hackers. Stuff that matters.

A comment on Speed up your Python using Rust. Parent comment

Re:Speed up your Python using Rust by gpm on Friday November 17, 2017 @11:53AM (#15723635)
You're planning on downloading binaries and gpg keys from that site anyways. Either you trust it, in which case you might as well curl | bash, or you don't, in which case you shouldn't be running that script no matter how carefully you inspect it.

And of course you can inspect the bash script (not that it does you any good), curl > file; bash file. It's just that most people don't so that's not what is recommended .

[ Parent | on HN ]
Re:Speed up your Python using Rust by blub on Friday November 17, 2017 @12:05PM (#15723761)
No, you're completely wrong. The key is available in multiple places and has been available for a while, so there is some verification that can be done.

The binary will be checked by gpg, it shouldn't matter where it's from.

Finally, if the recommmendation is to run curl foo | sh, the bash script can literally not be inspected.

[ Parent | on HN ]
Re:Speed up your Python using Rust by jD91mZM2 on Sunday November 19, 2017 @07:09AM (#15733557)
Just separate the steps? Curl to a file, inspect it, and then execute it? I don't see the problem. Most users just don't care because it's official anyways.
[ Parent | on HN ]