Detecting the use of “curl | bash” server side

Re:Detecting the use of “curl | bash” server side by jlarocco on Tuesday December 27, 2022 @01:58PM (#34152320)

But that's how trust works. If you don't trust them to pull in safe dependencies, then you don't really trust them.

[ Parent | on HN ]

Re:Detecting the use of “curl | bash” server side by warkdarrior on Tuesday December 27, 2022 @04:09PM (#34153838)

There are various degrees of trust. One may trust a package maintainer to write correct, well-designed code and to maintain it. But should one trust that package maintainer to have solid security standards in their code repo, their CI/CD, and their distribution mechanism?

[ Parent | on HN ]