Hacker News new | ask | show | jobs
by geocrasher 1303 days ago
My issue with piping curl to bash is that so many of these installers are pure junk.

Case in point: I work in web hosting. Yesterday a customer came to me asking for root access to the node so they could run an installer for something. No. But they had already tried running it as their user. And everything in their user account was gone. Why?

Because the installer expected to run as root, and its variables couldn't be defined properly and so when it went to clean up after itself, it did

   rm -rf ~/$variable/
and since the variable was unassigned, that became

   rm -rf ~/
I might not have it exactly right, but that's what the effect was. Piping curl to bash is asking a lot of somebody who doesn't know what they're doing, and should raise the hackles of somebody who does. At the very least, download and view the script yourself before running it.