"curl ... | sudo bash"
Running "sudo dpkg -i somepackage.deb" is literally just as dangerous.
You *will* want to run code written by others as root on your system at least once in your life. And you *will not* have the resources to audit it personally. You do it every day.
What matters is trusting the source of that code, not the method of distribution "curl ... | sudo bash" is as safe as anything else can be if the curl URL is TLS-protected.
And it's just as bad an idea if it comes from some random untrusted place on the internet.
As you say, it's about trust and risk management. A distro repo is less likely to be compromised. It's not impossible, but more work is required to get me to run your malicious code via that attack vector.
But
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
But I've just never heard anyway complain about "noobs" installing deb packages. Ever.
Maybe I just missed it.
it is literally in the debian documentation: https://wiki.debian.org/DontBreakDebian
> One of the primary advantages of Debian is its central repository with many thousands of software packages. If you're coming to Debian from another operating system, you might be used to installing software that you find on random websites. On Debian installing software from random websites is a bad habit. It's always better to use software from the official Debian repositories if at all possible. The packages in the Debian repositories are known to work well and install properly. Only using software from the Debian repositories is also much safer than installing from random websites which could bundle malware and other security risks.
Your question does not apply to the case discussed at all, and if we modify it to apply, the answer does not argue your point at all.
And are URLs (w/ DNSSEC and TLS) really that easy to hijack?
During the Google Domains-Squarespace transition, there was a vulnerability that enabled relatively simple domain takeovers. And once you control the DNS records, it's trivial to get Let's Encrypt to issue you a cert and adjust the DNSSEC records to match.
https://securityalliance.notion.site/A-Squarespace-Retrospec...