curl -sSL https://install.pi-hole.net | bash
Yes, I know this is supposed to be a convenience thing, but I wish people wouldn't actively encourage this pattern.
> Our code is completely open, but piping to bash can be dangerous. For a safer install, review the code and then run the installer locally.
This allows an attacker to display one (safe) source when you view it in your browser on your workstation, or wget it, and serve a different (nefarious) source when you curl/pipe it.
So, a more complete analogy would be: a bottle that gives you a safe chemical compound when you extract it for analysis, but throws in some VX when you go to administer it.
To combat this sort of thing, @jbenet made hashpipe: https://jbenet.github.io/hashpipe
Summary: Fill your script with an invisible payload that fills any buffers, and put something time consuming (say `sleep 5`) early in your script in order to detect that the script is being executed directly rather than just stored to disk. If the client halts before having read all data, it is likely a `curl | bash` scenario. If it just keeps reading, it's a regular browser just downloading.
That way, it is the same as running cURL without piping the output to bash, so people can easily check the code without worrying if the server is sending them different code when they pipe to bash
Anyway, if you decide to live on the edge.. don't copy-paste: http://thejh.net/misc/website-terminal-copy-paste
You cannot look at version history, check a signed package, etc. etc.
If someone wants to root just a few select machines, you would want people to do a curl install.
I can't stop people from doing potentially dangerous things, but I don't have to promote those things, either.
`curl -sSL https://install.pi-hole.net`
It's only 1400 lines of code.
At least it has TLS to prevent a MITM
I doubt step-by-step instructions including a review of the script's content would improve the average user's security, in much the same way that click-through ToS dialogs always garner such much scrutiny.
Edit: another comment quoted the warning on the page, at this point it feels like complaining is tilting at windmills.
Why do you care so much about what people do or don't do?
Edit: We're talking about blocking ads, right? If people encouraged everyone to block ads what would happen to the economy?