zlacker

>>pictur+(OP)
> Javascript plus a "curl | sudo sh" attitude to life equals "yeah no, I am never touching this thing".

I get why there are people that don’t like how some installers do this, but this trope is really turning into the “but I don’t even own a TV” of OSS commentary.

Just use the Docker image if you don’t like it. Or get their appliance which actually supports ongoing development.

>>karlsh+h3
Surely these are the same kinds of people who will carefully review all scripts before running them, right?

>>Waterl+J4
Even if you don't review it before running it, after

  $ curl https://whatever/foo.sh > foo.sh
  $ sh foo.sh

if something goes terribly wrong you can examine foo.sh to try to figure out what happened and how to fix it. Even if foo.sh managed to delete itself you can just grab it again.

After

  $ curl https://whatever/foo.sh | sh

if something goes wrong and you then try

  $ curl https://whatever/foo.sh > foo.sh

to get a copy of the script to examine a malicious server can tell that you aren't piping to a shell [1] and give a non-malicious script.

Since it takes an insignificant amount of effort to defend against this why not get in the habit of doing it?

[1] >>17636032