Re:curl | sh
by brian_c on Monday November 03, 2014 @09:51AM
(#8551007)
`curl ... | sh` installations don't really bother me. The scripts tend to be short and commented, or at least readable. Sure beats running an opaque .pkg installer, which invariably asks for your password (presumably for no reason) and installs god-knows-what all over your hard drive.
[ Parent
| on HN ]
Generally, yes, but some package managers have code-signing support, which means if you trust the authors, you can avoid potential hijacks.
At the end of the day, though, you're always going to trust someone with something.
Re:curl | sh
by jammycakes on Monday November 03, 2014 @09:57AM
(#8551038)
Yes, but if you're doing curl ... | sh then you're not vetting the script you're running before you run it. If you were, you'd be running curl and sh as separate commands.