Hacker News Reader

Comment by parliament32 | Hacker News Reader

    $ bash <(curl ...

Seeing this in a README immediately indicates that the author has no idea what they're doing security-wise, and that I probably shouldn't trust their project.

View on HN

I've never understood why people think this is somehow less secure than downloading a binary blob you can't inspect and running that instead.

I don't think I've ever downloaded and executed a binary blob. Either use a package manager or compile from source, it's really not that hard.

How is compiling and executing source you didn't examine any more secure than executing a bash script?

It's not like package managers are immune either: https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_st...

Not necessarily ... there are many high profile projects that recommend installation this way. NodeJS and HomeBrew come to mind. Unfortunately it's sort of becoming a standard practice these days.

Pretty sure even like homebrew does the same thing, chief

whats the issue here? (genuine question) besides having to trust the author? and what installation methods do you recommend for cli tools?

A package manager.

https://www.seancassidy.me/dont-pipe-to-your-shell.html

https://sysdig.com/blog/friends-dont-let-friends-curl-bash/

https://news.ycombinator.com/item?id=12766049

Bonus points: serving a different script to people piping to bash, and those not:

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

looks like the author also provides package manager installation on further reading of the readme. I'm still not quite seeing the issue with the curl to bash, I'm trusting the author by running their tool, regardless of the installation method. And I could always download the script first to check it right?

ah I see, the greater risk of mitm attack due the script not being hosted by a package manager, fair enough.

Reply on news.ycombinator.com