6 ms·

Homebrew, rbenv, rvm, to name a few. Never understood it either. If you could get ahold of a domain write a malicious script at /some-script.sh, you could do

Homebrew, rbenv, rvm, to name a few. Never understood it either. If you could get ahold of a domain write a malicious script at /some-script.sh, you could do a lot of damage.

halvsjur 14y ago
I agree that it feels insecure, but is there really a difference between this and downloading and running files from a .tar.gz or installing a .deb for example?
- foobarqux 14y ago
  debs are authenticated.
- dfc 14y ago
  Yes. apt-get: $ ls -l /etc/apt/trusted.gpg.d/ Source Installation: $ wget http://nmap.org/dist/sigs/nmap-6.01.tgz.asc $ wget http://nmap.org/dist/nmap-6.01.tgz $ gpg nmap-6.01.tgz.asc
  - sgt 14y ago
    The point is that most people don't do this.
    - dfc 14y ago
      Its built into apt. Unless you are suggesting that most people do: # apt-get --allow-unauthenticated ...
  - willholloway 14y ago
    This is an important part of why Debian and its derivatives are superior to OS X for web development. If you like Mac hardware like I do, at least run a Linux distro as a virtual machine and save yourself the trouble of Homebrew or its contemporaries.
- jaredonline 14y ago
  With a .tar.gz you can verify a checksum.