|
| ▲ | kokx 2 hours ago | parent | next [-] |
| It's not piped to a shell, but to the tar program with specific parameters to directly unpack the tar. You're still installing the program directly from github of course, instead of a source where hopefully a third party has also looked at it (like a package repository). But this is a lot better than the curl | sh pattern. |
| |
| ▲ | tgv an hour ago | parent [-] | | You're not downloading from github, but from dl.jitpass.com. And an executable can do exactly the same as a shell script. The point is that whatever you're executing isn't verified, whether it's a shell script or a binary. | | |
| ▲ | QuantumNomad_ an hour ago | parent | next [-] | | > The point is that whatever you're executing isn't verified, whether it's a shell script or a binary. The GP said: > This should be an ordinary app bundle to drop into /Applications There is no difference between downloading an app bundle that you drop into /Applications, and curling a binary that you put in /usr/local/bin/ | |
| ▲ | ZiiS an hour ago | parent | prev [-] | | The difference is you have the executable for examination (at least a quick virus scan) before you run it. Certanly not perfect, but what is? | | |
| ▲ | fragmede 18 minutes ago | parent | next [-] | | Is there McAfee for Mac? There's no real difference. You're trusting someone not to root your shit. Whether it's via curl, dmg, or apt, we have no idea who anybody really is, so it's all on an assumption that people aren't evil. Unfortunately it turns out that there are evil people out there, but doing it via curl | bash or downloading a dmg or though some app store, there's still evil that's gonna get you if you end up trusting in the wrong people. | |
| ▲ | hnlmorg an hour ago | parent | prev [-] | | You can still do that with their install instructions ;) | | |
| ▲ | ZiiS 3 minutes ago | parent [-] | | That is what I am saying, you are trusting them, but less then `curl | sh` |
|
|
|
|
|
| ▲ | QuantumNomad_ 2 hours ago | parent | prev | next [-] |
| But it’s not piping a script into the shell. It’s curl downloading a compressed archive and piping it to tar to decompress the program binary from the archive. Then moving the extracted binary into /usr/local/bin. |
|
| ▲ | hackernudes 2 hours ago | parent | prev | next [-] |
| Technically this one is piping it to tar? But I agree with the sentiment. |
|
| ▲ | vlaaad 2 hours ago | parent | prev [-] |
| It's curl | tar, not curl | sh |
