| ▲ | thecopy 4 hours ago |
| >Anything that suggests curl into bash just plain sketches me out. How is it different than trusting any other method of installation? If URL has https and is from an author you trust i dont see the difference. |
|
| ▲ | thebeardisred 3 hours ago | parent | next [-] |
| Package management provides cryptographic attestation over the entire process, including the scripts run. Nothing is arbitrary nor mutable in the default state. The files touched will be in a predictable place and the scope of privilege escalation is clearly defined. |
| |
| ▲ | BloondAndDoom 3 hours ago | parent | next [-] | | But he’s not using a package, he’s downloading from gir repo and build which exactly same getting a bash script from the same repo and executing it. | | |
| ▲ | rusk 3 hours ago | parent [-] | | It’s not. Try pulling updates after a rebase. Very much not the same as piping arbitrary disembodied text into your shell. | | |
| |
| ▲ | thecopy 3 hours ago | parent | prev [-] | | >Nothing is arbitrary nor mutable in the default state. What do you mean with this? |
|
|
| ▲ | JetSetIlly 3 hours ago | parent | prev | next [-] |
| It's more about installation location for me. For these types of projects, I don't even install it. I just clone, build and run from there. I have no idea where the bash script is going to put things. |
| |
| ▲ | mr_mitm 2 hours ago | parent [-] | | Which also makes it not obvious how to uninstall it. pip/npm/cargo etc have well known mechanisms for that. curl|sh is convenient for container images I guess. |
|
|
| ▲ | walrus01 4 hours ago | parent | prev | next [-] |
| I mean it's probably not, I just haven't got used to it yet. It's about the same level of security as installing a windows app on win2000 25 years ago and blindly downloading a .exe off the internet and running it to get into the install wizard. But indeed I also kind of blindly trust that whatever I'm getting from the debian trixie officially gpg-signed packages isn't backdoored. One thing I do not do as a matter of practice is install things with a ridiculous number of recursive npm dependencies. |
| |
| ▲ | uecker 2 hours ago | parent [-] | | I do not blindly trust anything, and come to the conclusion that downloading binaries from Debian trixie is a lot more safe. There is a world of difference between "curl | sh" and downloading from a curated package repository maintained by a respected community with well-defined processes. |
|
|
| ▲ | danielrmay 3 hours ago | parent | prev [-] |
| Rendered text cannot be assumed to equal the underlying text, unfortunately |
| |
| ▲ | thecopy 3 hours ago | parent | next [-] | | How so? As i understand your point, this would mean we cannot trust GitHub enough to return the same content in git clone vs curl? | | |
| ▲ | danielrmay 3 hours ago | parent [-] | | As an example, webfonts can make rendered text differ from the underlying text that ends up on your clipboard. | | |
| ▲ | thecopy 2 hours ago | parent [-] | | Sure, but doesn't this assume that you cannot the publisher anyway? So why would you not trust their homepage but trust their source-code | | |
|
| |
| ▲ | cybrox 3 hours ago | parent | prev [-] | | Download and inspect it. |
|
