Hacker News new | ask | show | jobs
by joshmanders 1353 days ago
As an FYI - The bash script downloads it and then runs bash on the file created on your local system, there's no way to determine if the user is downloading and piping directly into bash or if they're just downloading the file, so change the script before executing from

    wget -q https://get.coollabs.io/coolify/install.sh -O install.sh; sudo bash ./install.sh
to

    wget -q https://get.coollabs.io/coolify/install.sh -O install.sh; cat install.sh
Once the script is locally on your file system there is no way to change the contents.
1 comments

Yep. My response was specific to your comment of reading in browser which is not a guarantee of what's downloaded.
My apologizes, I interpreted it as a "yeah but they can change it so you can't trust it!!!1!" response.