It's less about malicious intent and more about predictability.
When I install software on my computer with apt, I trust that all the files will go to the right place and install scripts are going to do sane things relative to the rest of the system. And I can just uninstall the whole thing with one command later if I so choose.
If I curlpipe a script, I get none of those guarantees. I have seen curlpipes that put files in weird places, guess the wrong OS, and mess with config files that I didn't want them to touch. When they break or I want to uninstall, I have to sit down and understand a (possibly minified) script to clean things up manually.
Yes containers are a half solution to this, no I don't want to use containers 100% of the time.
its a good way to check if people are insane though. would be a cool tactic for new hire evaluation, monitor them setting up dev environment. do the curl | bash, and its instafail
In countless corporate environments (including in highly regulated industries), far from being a firable offense, piping curl to bash is often a prescribed step in setting up the standard dev env. The cognitive dissonance is soul crushing. Maybe they're testing for one's ability to tolerate it.
Why not? The web uses TLS, how's it different security-wise compared to a package download?
It's less about malicious intent and more about predictability.
When I install software on my computer with apt, I trust that all the files will go to the right place and install scripts are going to do sane things relative to the rest of the system. And I can just uninstall the whole thing with one command later if I so choose.
If I curlpipe a script, I get none of those guarantees. I have seen curlpipes that put files in weird places, guess the wrong OS, and mess with config files that I didn't want them to touch. When they break or I want to uninstall, I have to sit down and understand a (possibly minified) script to clean things up manually.
Yes containers are a half solution to this, no I don't want to use containers 100% of the time.
I feel the same, which is why I only use these tools in a docker container. Because life is compromise.
its a good way to check if people are insane though. would be a cool tactic for new hire evaluation, monitor them setting up dev environment. do the curl | bash, and its instafail
In countless corporate environments (including in highly regulated industries), far from being a firable offense, piping curl to bash is often a prescribed step in setting up the standard dev env. The cognitive dissonance is soul crushing. Maybe they're testing for one's ability to tolerate it.