Comment by thephyber
“Curl pipe sh” would like to have a word…
I think you are painting with a broad brush.
“Curl pipe sh” would like to have a word…
I think you are painting with a broad brush.
No it isn't. Package managers verify the cryptographically signed package. That means the package can be built on a secure server, and then if a mirror becomes malicious or gets compromised, the malicious package won't have a valid signature so the package will not be installed. Running curl and piping it into sh means that not only could a malicious mirror or compromised server execute anything they want on your computer, but they could even send a different script when you curl it into sh vs when you view it any other way, making it much harder to detect[0].
[0] https://web.archive.org/web/20240213030202/https://www.idont...
Thats like not wearing a seatbelt because you can still be crushed by a truck. Don't let perfect be the enemy of good. Package managers prevent some attacks that are possible via curl | sh. Some other attacks are still possible. It is still better than not cryptographically verifying the package.
This is no different from installing a random package through a package manager. If you're running "curl pipe sh" because an email told you to, that's on you.