zlacker

The obsession against shell pipes is so absolutely absurd. You’d download a dmg and drag it to your apps but not shell pipe? You’ll sudo dpkg -i but not a shell pipe?

Can anyone point to a single case of a shell pipe ever being abused ever?

>>dev_du+(OP)
If a tree falls in a forest and no one is around to hear it, does it make a sound?

I certain that someone has been exploited using shell pipes.

>>dev_du+(OP)
I'd like to point out that the author is not directly discrediting shell pipes.

> a knowledgable user will most likely check the content first

The obvious workaround would be to download with curl, inspect, then run the virtually same inspected file through bash. This workflow is easier without necessarily using pipes. Package files can also be inspected before running and are not directly inspected in the browser.

Trust on the other hand is more complicated. Without doing tedious manual inspecting, you have to rely on the distributor. In this case, public keys aid in this regard, but also does not work with the `curl | bash` workflow.

>>dev_du+(OP)
Bash: execute an unsigned script to install an unsigned payload. Probably requires admin rights.

dmg: download an archive file which contains a signed payload which is copied to Apps. Admin rights are used for copying only.

The difference is blindingly obvious.