8 ms·
This spooks me a little. Common sense says you should never, ever run "curl something | sh" (or equivilant), especially not with elevated privileges.
by jperry 7y ago
This spooks me a little. Common sense says you should never, ever run "curl something | sh" (or equivilant), especially not with elevated privileges.
- jlelse 7y agoYes, that's good common sense. But you can check the source code on GitHub (it's deployed directly via GitHub Pages) or first download it and then execute without pipe from curl.
- _frkl 7y agoYeah, or just host it yourself once reviewed. That's what I do usually (not with this haven't heard of this before), but with scripts I find now and then).
- stephenr 7y agoIt’s a fucking terrible pattern that gets used by a whole heap of tools. https://curlpipesh.tumblr.com/ https://curlpipesh.tumblr.com/ The ridiculous ones are where it just sets up an apt repo - like someone can’t add a file with a line or two of text and run two very common commands (apt update/install). Edit: these ones are just ridiculous. “Here, download this stuff using curl... also you’ll need wget”.