Re:Bpkg – a Bash package manager
by vezzy-fnord on Monday September 22, 2014 @04:27PM
(#8352417)
Obligatory mention: http://russianroulette.sh
As a warning, it actually is dangerous to run, but it conveys the point succinctly.
That's funny, but I think the idea of bpkg is to be the last tool you'd have to install the failing-grade way and use bpkg for any future tools on various platforms and all.
technically, they don't recommend it. curl whatever | bash is one of the 3 possible method (first listed, I agree) but there are 2 other ways to install it.
otoh, don't you think that without the unsecure one liner to install it, some people would complain about its lack ? Stating they can read the script before executing it anyway.
Plus, it's not much less secure than cloning a repo and running 'make install' (in both case, one could read the script(s) but will unlikely do so).
Exactly my thoughs, too! When you clone and make blindly, it's not any safer.
How is this any different from?:
$ curl http://supersecure.script -O foo.sh
$ bash foo.sh
Re:Bpkg – a Bash package manager
by rottingchris on Tuesday September 23, 2014 @04:11AM
(#8354464)
The connection can break mid-download leaving you with a partially executed script.
Is there time for a service that looks at any README on a github project or other indexable repos, and give it a cute landing page and failing grade if the install recommends curl http://supersecure.script - | bash # fuck my box.
Perhaps ismyboxvaklem.pt?