you are viewing a single comment's thread
view the rest of the comments
[–] 78 points 1 year ago* (4 children)

You must run curl http://totallylegitwebsite.ru/install | sudo sh, it's the only way to install our product. Don't even look at the several thousand lines of illegible shell script, just pipe it straight to your shell. We are a very serious project.

  • source
  • hideshow 4 child comments
  • [–] 25 points 1 year ago (2 children)

    I hate this model, but if you trust the website, piping to shell is exactly as safe as downloading and executing a installer. (Yeah yeah, https, function executed on last line, etc)

  • source
  • parent
  • hideshow 2 child comments
  • [–] 22 points 1 year ago (1 child)

    I don't want to trust a website, which is susceptible to typos and lookalikes (see e.g. putty.org) and relies on countless other services that can inject malware.

    Code signing was creates for this reason: ensure that the program is authentic and unaltered. Package managers do this perfectly.

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (1 reply)