[jperry]

This spooks me a little. Common sense says you should never, ever run "curl something | sh" (or equivilant), especially not with elevated privileges.

[stephenr]

It’s a fucking terrible pattern that gets used by a whole heap of tools.

https://curlpipesh.tumblr.com/

The ridiculous ones are where it just sets up an apt repo - like someone can’t add a file with a line or two of text and run two very common commands (apt update/install).

Edit: these ones are just ridiculous.

“Here, download this stuff using curl... also you’ll need wget”.

[jlelse]

Yes, that's good common sense. But you can check the source code on GitHub (it's deployed directly via GitHub Pages) or first download it and then execute without pipe from curl.

[_frkl]

Yeah, or just host it yourself once reviewed. That's what I do usually (not with this haven't heard of this before), but with scripts I find now and then).