The Rust community's crate host

Re:The Rust community's crate host by ajross on Thursday November 20, 2014 @09:47PM (#8639537)

But... you can't get a hash from somebody you trust with this scheme. The script downloads and runs and throws itself away with no attempt made to authenticate anything (well, I guess there's the TLS cert as it's a https url -- that's something at least).

Or if it's there somewhere I don't see it. Where it it?

[ Parent | on HN ]

Re:The Rust community's crate host by chc on Friday November 21, 2014 @02:27PM (#8642866)

The point is that if you're paranoid, you won't pipe curl into sh just like you won't blindly trust an unauthenticated hash. There is nothing stopping you from putting more effort into installing this software just like there's nothing stopping you from putting more effort into installing an apt package of questionable provenance.

[ Parent | on HN ]