Hacker News Reader

I don't see how this is less secure than downloading a program and running it. Or downloading some package that asks you to run an install script.

People will see no problem with curl | sh as long as they feel they can trust the source/site asking them to do so. They will be running the same risk as with downloading binaries or install packages.

View on HN

The truncation issue is an interesting additional wrinkle, if unlikely.

I agree that, aside from that issue, the practice of many people is not materially worse than "curl | sh", but we should condemn that similarly.

Exactly. This is little more than cargo culting.

I'd at least save the script somewhere so i can audit it if something goes wrong after i run it.

Reply on news.ycombinator.com