Hacker News Reader

Things like this make me die a little inside every time:

> Open a fresh terminal and enter this command: /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/in...

View on HN

why?

You’re executing a script directly off of a git repo. There’s a lot of trust involved there. One sneaky pull-request away from an exploit.

That said, I do it all the time like everyone else. :)

That's the official installation instruction of homebrew. http://brew.sh/

But anyway I got your point.

That doesn't make it any less terrible, but honestly who expects more from homebrew, as a project it's hardly the pinnacle of engineering excellence.

As others have said, blinding executing a ruby script directly out of a GH repo is risky (to put it mildly). Sure, you have to have some trust in the whole infrastructure at some point, but the number of times I've seen this type of thing blindly posted and followed boggles my mind. Here is a post talking about the issue and pointing out non-malicious issues: https://www.seancassidy.me/dont-pipe-to-your-shell.html

Reply on news.ycombinator.com