Thread

1. deadbunny · 1791120801 · focus · HN ↗

   &gt; Set up Strata on this PC for me: <a href="https:&#x2F;&#x2F;github.com&#x2F;Niko1221&#x2F;Strata" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Niko1221&#x2F;Strata - follow docs&#x2F;AI_SETUP.md in that repository.

   And I thought piping to bash was bad

   1. Skunkleton · 1791126347 · focus · HN ↗

      I&#x27;ve never understood the security argument people are making when they complain about `curl foo | bash`. I get that these scripts sometimes mess up your bashrc or whatever, but from a security perspective I see no issue. You are already installing software from the same domain. If they were going to do something nasty, they could do it with any of the software you are using from them. It doesn&#x27;t have to be the setup script.

      1. layer8 · 1791127281 · focus · HN ↗

         I push binaries from untrusted sources through VirusTotal before running them. Piping a Bash script from curl bypasses that. Furthermore, such Bash scripts, when they aren’t self-contained, make security checks more difficult than a self-contained archive, installer, or binary, even when downloading the script without immediate execution.

         1. parsimo2010 · 1791129389 · focus · HN ↗

            You could always curl the install script, and modify it to run the virus scan in between the build and install steps.

Unofficial Hacker News client; not affiliated with Y Combinator.