Comment by 0xbadcafebee 2 months ago curl -fsSL https://get.docker.com/rootless | sh 11 comments 0xbadcafebee Reply MrDrMcCoy 2 months ago Please stop spreading this toxic curl|sh nonsense. It's wildly corrosive to security and system stability. gruez 2 months ago Is it really that much worse than using a package manager that drops a binary that you're not going to inspect anyways? LelouBil 2 months ago Yes, it is worse because using your package manager trusts your distribution (and the packages packager), doing curl bash trusts a random website.While in this case docker is not a random website, it's best to use the package manager when available 4 replies → 0xbadcafebee 2 months ago Actually it is much worse, I agree with the commenter MrDrMcCoy 2 months ago Packages are signed, and contain manifests to check for file conflicts and help with cleanly uninstalling. The script installer might make bad assumptions during install that a package manager would catch. karel-3d 2 months ago this is a thread about agents that run random things on your computer as root because they feel like it. curl|sh somehow seems mild in comparison HDBaseT 2 months ago Whilst true, you can pretty easily assume and validate the result of that command.
MrDrMcCoy 2 months ago Please stop spreading this toxic curl|sh nonsense. It's wildly corrosive to security and system stability. gruez 2 months ago Is it really that much worse than using a package manager that drops a binary that you're not going to inspect anyways? LelouBil 2 months ago Yes, it is worse because using your package manager trusts your distribution (and the packages packager), doing curl bash trusts a random website.While in this case docker is not a random website, it's best to use the package manager when available 4 replies → 0xbadcafebee 2 months ago Actually it is much worse, I agree with the commenter MrDrMcCoy 2 months ago Packages are signed, and contain manifests to check for file conflicts and help with cleanly uninstalling. The script installer might make bad assumptions during install that a package manager would catch. karel-3d 2 months ago this is a thread about agents that run random things on your computer as root because they feel like it. curl|sh somehow seems mild in comparison HDBaseT 2 months ago Whilst true, you can pretty easily assume and validate the result of that command.
gruez 2 months ago Is it really that much worse than using a package manager that drops a binary that you're not going to inspect anyways? LelouBil 2 months ago Yes, it is worse because using your package manager trusts your distribution (and the packages packager), doing curl bash trusts a random website.While in this case docker is not a random website, it's best to use the package manager when available 4 replies → 0xbadcafebee 2 months ago Actually it is much worse, I agree with the commenter MrDrMcCoy 2 months ago Packages are signed, and contain manifests to check for file conflicts and help with cleanly uninstalling. The script installer might make bad assumptions during install that a package manager would catch.
LelouBil 2 months ago Yes, it is worse because using your package manager trusts your distribution (and the packages packager), doing curl bash trusts a random website.While in this case docker is not a random website, it's best to use the package manager when available 4 replies →
MrDrMcCoy 2 months ago Packages are signed, and contain manifests to check for file conflicts and help with cleanly uninstalling. The script installer might make bad assumptions during install that a package manager would catch.
karel-3d 2 months ago this is a thread about agents that run random things on your computer as root because they feel like it. curl|sh somehow seems mild in comparison
HDBaseT 2 months ago Whilst true, you can pretty easily assume and validate the result of that command.
Please stop spreading this toxic curl|sh nonsense. It's wildly corrosive to security and system stability.
Is it really that much worse than using a package manager that drops a binary that you're not going to inspect anyways?
Yes, it is worse because using your package manager trusts your distribution (and the packages packager), doing curl bash trusts a random website.
While in this case docker is not a random website, it's best to use the package manager when available
4 replies →
Actually it is much worse, I agree with the commenter
Packages are signed, and contain manifests to check for file conflicts and help with cleanly uninstalling. The script installer might make bad assumptions during install that a package manager would catch.
this is a thread about agents that run random things on your computer as root because they feel like it. curl|sh somehow seems mild in comparison
Whilst true, you can pretty easily assume and validate the result of that command.