Hacker News Reader

How is it worse than: $ ./configure && make

I guarantee you that it'd be easier to hide something nefarious in 3000 lines of autoconf boilerplate.

It's not. And at least the download here is over HTTPS, not HTTP. But you are right, both are vulnerable unless the user is ready to be cautious.

Well if it's not, then how exactly is it "evil"? Do you audit install scripts and source code before using software?

Well, technically, I trust the Debian developers to do that for me. And I verified that they have approved of the software automatically, by checking their signatures on the Release file, which contains the hashes of the packages.

So you only install signed Debian packages then?

If I have the option to, yes. Or rather I take much less care to actually read the code when I am installing a package out of the Debian repo's. Otherwise, I at least try to review what the heck that I am installing, especially on my own machine.

Reply on news.ycombinator.com