Show HN: Distro.tools - Scripts for lazy Linux users

by jlelse • 7 years ago

14 4 7 years ago

jperry• 7 years ago

This spooks me a little. Common sense says you should never, ever run "curl something | sh" (or equivilant), especially not with elevated privileges.

jlelse• 7 years ago

Yes, that's good common sense. But you can check the source code on GitHub (it's deployed directly via GitHub Pages) or first download it and then execute without pipe from curl.

_frkl• 7 years ago

Yeah, or just host it yourself once reviewed. That's what I do usually (not with this haven't heard of this before), but with scripts I find now and then).

stephenr• 7 years ago

It’s a fucking terrible pattern that gets used by a whole heap of tools.

https://curlpipesh.tumblr.com/

The ridiculous ones are where it just sets up an apt repo - like someone can’t add a file with a line or two of text and run two very common commands (apt update/install).

Edit: these ones are just ridiculous.

“Here, download this stuff using curl... also you’ll need wget”.

Show HN: Distro.tools - Scripts for lazy Linux users

Related Stories