Package management provides cryptographic attestation over the entire process, including the scripts run. Nothing is arbitrary nor mutable in the default state. The files touched will be in a predictable place and the scope of privilege escalation is clearly defined.
replyBut he’s not using a package, he’s downloading from gir repo and build which exactly same getting a bash script from the same repo and executing it.
replyIt’s not. Try pulling updates after a rebase. Very much not the same as piping arbitrary disembodied text into your shell.
replyExcept the first time you do it
reply>Nothing is arbitrary nor mutable in the default state.
replyWhat do you mean with this?
It's more about installation location for me. For these types of projects, I don't even install it. I just clone, build and run from there. I have no idea where the bash script is going to put things.
replyWhich also makes it not obvious how to uninstall it. pip/npm/cargo etc have well known mechanisms for that.
replycurl|sh is convenient for container images I guess.
I mean it's probably not, I just haven't got used to it yet. It's about the same level of security as installing a windows app on win2000 25 years ago and blindly downloading a .exe off the internet and running it to get into the install wizard. But indeed I also kind of blindly trust that whatever I'm getting from the debian trixie officially gpg-signed packages isn't backdoored.
replyOne thing I do not do as a matter of practice is install things with a ridiculous number of recursive npm dependencies.
I do not blindly trust anything, and come to the conclusion that downloading binaries from Debian trixie is a lot more safe. There is a world of difference between "curl | sh" and downloading from a curated package repository maintained by a respected community with well-defined processes.
replyRendered text cannot be assumed to equal the underlying text, unfortunately
replyHow so? As i understand your point, this would mean we cannot trust GitHub enough to return the same content in git clone vs curl?
replyAs an example, webfonts can make rendered text differ from the underlying text that ends up on your clipboard.
replySure, but doesn't this assume that you cannot the publisher anyway? So why would you not trust their homepage but trust their source-code
reply[dead]
replyDownload and inspect it.
reply