|
|
|
|
|
|
by deadbunny
703 days ago
|
|
|
> Pipe to sh is simple, transparent Not so transparent[1]. Packages from a package repo are signed, usually with keys not stored on the same server so if someone nefarious breached a server they can easily replace a bash script, they can't re-sign and replace a package. Sure it's safe if you download the script then review it then install it, but hey, you reviewed it last time, it's probably unchanged, what's the harm of piping it directly to bash next time you need to get set https://web.archive.org/web/20240228190305/https://www.idont... |
|
|