curl https://some-url/ | sh

I see this all over the place nowadays, even in communities that, I would think, should be security conscious. How is that safe? What’s stopping the downloaded script from wiping my home directory? If you use this, how can you feel comfortable?

I understand that we have the same problems with the installed application, even if it was downloaded and installed manually. But I feel the bar for making a mistake in a shell script is much lower than in whatever language the main application is written. Don’t we have something better than “sh” for this? Something with less power to do harm?

  • HelloRootEnglish
    151·
    9 hours ago

    All the software I have is downloaded from the internet…

    • Ephera@lemmy.mlEnglish
      3·
      2 hours ago

      It is kind of cool, when you’ve actually written your own software and use that. But realistically, I’m still getting the compiler from the internet…

    • WhatAmLemmy@lemmy.worldEnglish
      181·
      9 hours ago

      You should try downloading the software from your mind brain, like us elite hackers do it. Just dump the binary from memory into a txt file and exe that shit, playa!