Hacker News Reader

Comment by bru | Hacker News Reader

Side-note for the author: the download can be made more elegant that way

    $ curl http://shortfin.io/install.sh | sh

I definitely agree with the HTTPS. For example this is what meteor proposes:

    $ curl https://install.meteor.com | sh

View on HN

asdfsdfgkjlsdfg!

Streaming your install script directly into computer execution without even giving it a once-over, md5 compare, etc is atrociously insecure.

That's completely orthogonal to what we're talking about here. If you're already not doing it, you're not doing it any less by being more efficient. And it doesn't really matter if you're running it in a throwaway VM like I do.

    curl https://install.meteor.com  | less

This seems to be a common complaint but I can't see any reason you can't give it a once over when it's hosted on the web…

Reply on news.ycombinator.com