News for hackers. Stuff that matters.
Re:Show HN: Distro.tools - Scripts for lazy Linux users by jperry on Tuesday April 23, 2019 @10:38AM (#19729040)
This spooks me a little. Common sense says you should never, ever run "curl something | sh" (or equivilant), especially not with elevated privileges.
Re:Show HN: Distro.tools - Scripts for lazy Linux users by stephenr on Tuesday April 23, 2019 @01:01PM (#19730549)
It’s a fucking terrible pattern that gets used by a whole heap of tools.

https://curlpipesh.tumblr.com/

The ridiculous ones are where it just sets up an apt repo - like someone can’t add a file with a line or two of text and run two very common commands (apt update/install).

Edit: these ones are just ridiculous.

“Here, download this stuff using curl... also you’ll need wget”.

Re:Show HN: Distro.tools - Scripts for lazy Linux users by jlelse on Tuesday April 23, 2019 @01:01PM (#19730544)
Yes, that's good common sense. But you can check the source code on GitHub (it's deployed directly via GitHub Pages) or first download it and then execute without pipe from curl.
Re:Show HN: Distro.tools - Scripts for lazy Linux users by _frkl on Thursday April 25, 2019 @11:25AM (#19749119)
Yeah, or just host it yourself once reviewed. That's what I do usually (not with this haven't heard of this before), but with scripts I find now and then).