Hacker News Reader

Comment by thecopy | Hacker News Reader

>Anything that suggests curl into bash just plain sketches me out.

How is it different than trusting any other method of installation? If URL has https and is from an author you trust i dont see the difference.

View on HN

Package management provides cryptographic attestation over the entire process, including the scripts run. Nothing is arbitrary nor mutable in the default state. The files touched will be in a predictable place and the scope of privilege escalation is clearly defined.

But he’s not using a package, he’s downloading from gir repo and build which exactly same getting a bash script from the same repo and executing it.

It’s not. Try pulling updates after a rebase. Very much not the same as piping arbitrary disembodied text into your shell.

Except the first time you do it

>Nothing is arbitrary nor mutable in the default state.

What do you mean with this?

It's more about installation location for me. For these types of projects, I don't even install it. I just clone, build and run from there. I have no idea where the bash script is going to put things.

Which also makes it not obvious how to uninstall it. pip/npm/cargo etc have well known mechanisms for that.

curl|sh is convenient for container images I guess.

I mean it's probably not, I just haven't got used to it yet. It's about the same level of security as installing a windows app on win2000 25 years ago and blindly downloading a .exe off the internet and running it to get into the install wizard. But indeed I also kind of blindly trust that whatever I'm getting from the debian trixie officially gpg-signed packages isn't backdoored.

One thing I do not do as a matter of practice is install things with a ridiculous number of recursive npm dependencies.

I do not blindly trust anything, and come to the conclusion that downloading binaries from Debian trixie is a lot more safe. There is a world of difference between "curl | sh" and downloading from a curated package repository maintained by a respected community with well-defined processes.

Rendered text cannot be assumed to equal the underlying text, unfortunately

How so? As i understand your point, this would mean we cannot trust GitHub enough to return the same content in git clone vs curl?

As an example, webfonts can make rendered text differ from the underlying text that ends up on your clipboard.

Sure, but doesn't this assume that you cannot the publisher anyway? So why would you not trust their homepage but trust their source-code

Download and inspect it.

Reply on news.ycombinator.com