Hacker News Reader

"And let’s not forget that so much Linux software installs these days via curl|sh... "

Actually virtually everything is packaged for at least the major linux platforms an exhortation on a web site saying you can install foo via curl |sh can in fact normally be reasonably followed by apt install foo or insert gui/cli package manager of your choice.

View on HN

When I use apt-get I am downloading from debian.org, where at least there will be a record of what was executed. Further, I trust debian.org more than some random github repo.

When I use curl|sh, I could execute hidden text, e.g. through a Javascript command, which automatically executes the code and then deletes it from my history. At a future date, there is no way for me to know whether something malicious was executed, since the website may remove the malicious code when they get called out.

You're agreeing.

Reply on news.ycombinator.com