Hacker News new | ask | show | jobs
by polityagent 2326 days ago
whats the issue here? (genuine question) besides having to trust the author? and what installation methods do you recommend for cli tools?
1 comments
parliament32 2326 days ago
A package manager.

https://www.seancassidy.me/dont-pipe-to-your-shell.html

https://sysdig.com/blog/friends-dont-let-friends-curl-bash/

https://news.ycombinator.com/item?id=12766049

Bonus points: serving a different script to people piping to bash, and those not:

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

link
polityagent 2326 days ago
looks like the author also provides package manager installation on further reading of the readme. I'm still not quite seeing the issue with the curl to bash, I'm trusting the author by running their tool, regardless of the installation method. And I could always download the script first to check it right?
link
polityagent 2326 days ago
ah I see, the greater risk of mitm attack due the script not being hosted by a package manager, fair enough.
link