Re:Git password authentication is shutting down
by geofft on Thursday August 12, 2021 @06:55PM
(#28162688)
Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD/USB image and booting it up "bad practice."
You have to trust the place where you're downloading it from, of course. But there's nothing inherently worse about /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)" than burning https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/de... and booting it up.
Re:Git password authentication is shutting down
by bombela on Friday August 13, 2021 @01:00AM
(#28165628)
Why the downvotes on the parent? It's literally the same thing: running random code from the internet on your computer!
Re:Git password authentication is shutting down
by sethammons on Thursday August 12, 2021 @10:25PM
(#28164625)
You can actually detect from the server side if curl is being piped and dynamically change the payload.
Re:Git password authentication is shutting down
by geofft on Thursday August 12, 2021 @11:53PM
(#28165234)
Yes! I'm not sure how that changes what I'm saying. If you don't trust the server, it can give you a malicious ISO, too.
Or are you saying that you audit the bits of the ISO yourself before burning it?
Re:Git password authentication is shutting down
by throwaway2037 on Friday August 13, 2021 @03:07AM
(#28166306)
Woah. How? Assume scrubber request headers.
It walks you through installing a "cask" using "brew". It doesn't mention how to install homebrew but instead directs you to the homebrew homepage which shows the output of a curl command being fed to `bash -c`. Something that's both bad practice and unintelligible unless you're quite familiar with Unix shells. If everything works as intended, you're good to go! But if anything goes wrong, or you have to update the "cask" in the future you're left with little to no context about what you just did.
For someone unfamiliar with Unix shell commands, homebrew, curl, etc. this is a quagmire that can take days to unravel without someone there to help them.