Agreed with everything up to:

"curl-to-shell pipe to install" - what's the problem here? that's pretty common on linux systems and something the AWS CLI uses.

Or is the problem the fact that this dev is untrusted and is executing a possibly malicious script on your machine?

▲

jasongi 2 hours ago | parent | next [-]

For a mock server? Surely a versioned, standalone executable, library/package or docker image makes more sense. Integration tests generally need to be portable and running on CI, you don't wanna be shell-piping whatever exists in the moment.

▲

MisterMunchkin 2 hours ago | parent | prev | next [-]

Running arbitrary code directly in your terminal is very dangerous

▲

luma an hour ago | parent [-]

Any code I didn't write is arbitrary code. At some point I'm left to trust someone or run no software at all.

	▲	mulmen an hour ago \| parent [-]
		It’s a shell script. You can download and read it before you run it. Piping it directly to the shell is reckless. I’m not sure how your machine is configured but mine has permission boundaries and security policies that make sure programs are behaving properly. I don’t run everything with my personal user context.

▲

sdcfgy 2 hours ago | parent | prev | next [-]

I'm worried that this behaviour has to be defended.

▲

x3n0ph3n3 40 minutes ago | parent | prev [-]

curl-to-shell is a terrible installation mechanism, because it's not easily reversible and I can't tell if any of the assets are signed, or integrity checked, or not.