Hacker News new | ask | show | jobs
by nsheridan 5025 days ago
I can't be the only person who hates install instructions like 'curl -L some.host|bash'. Not to mention that the yeoman install script happily installs homebrew using 'curl -k ... |ruby'. No thanks.
5 comments

If you don't trust such methods of installation, you don't have to use them. Also, you can always look at the source of the script if you don't trust said method and choose for if you want to install by hand, use the script, or just don't use the tool at all. You really can't fault Yeoman because they want to make it easy and painless to install their tool.

For the people that want to check out the script:

https://raw.github.com/yeoman/yeoman/master/setup/install.sh

Why? I completely understand the intent of "curl -L some.host|bash". Even if I don't have curl or bash, I immediately know what is happening.

It's obviously a concern that you are downloading unchecked code from the internet and running it on your computer, but if you are talented enough to be able to inspect the code and certify it is not malicious, you are also talented enough how to get the code without executing it.

Why? It's no different from any other installation method: http://gist.io/3670086

You're running code you haven't read. It all reduces to exactly the same vulnerability.

What do you prefer?
I honestly like it. I can actually read the source, as opposed to a pkg or or .app.

Do you think piping a shell script is less secure?