Thread

1. arialdomartini · 1791145038 · focus · HN ↗

   Stop the curl | bash insanity.

   <a href="https:&#x2F;&#x2F;nocurlbash.com&#x2F;#en" rel="nofollow">https:&#x2F;&#x2F;nocurlbash.com&#x2F;#en

   1. antihero · 1791152903 · focus · HN ↗

      Absolutely love the fact that they reference a &quot;real package manager&quot; like npm, which has been used in countless supply chain attacks, and brew, which can also run arbitrary scripts (though less likely in the mainline brew stuff, which many packages aren&#x27;t able to be in).

      Avoiding curlbashing is masking a deeper problem.

      1. Doctor_Fegg · 1791174080 · focus · HN ↗

         This. curl | bash has never nuked my local Postgres db, unlike one of the recommended package managers. Nor stopped my wife’s computer from booting, unlike a certain well known browser installer from one of the world’s biggest companies.

Unofficial Hacker News client; not affiliated with Y Combinator.