Hacker News new | ask | show | jobs
by feld 3512 days ago
But you're verifying the signature of the tarball first, right?
1 comments

Almost all of the examples on that page use curl https:// | sh. Which, again, makes it a superior option to wget && gpg --verify && ./configure; I have yet to see anyone who is better at PGP fingerprint verification than their OS's SSL stack is at TLS certificate verification. (There are a very small number of people who are as good, but not better.)