Ask HN: Alternative to curl https://install.foo.com | /bin/sh?

1 point

13 years ago

It's well known that curling a script from the internet and executing it directly like so,

    curl https://install.foo.com | /bin/sh

seems to be frowned upon [0][1] for security reasons[2][3]. However, it's an incredibly effective way to help bootstrap a development environment. What are the best approaches to achieving the same goal without going through lots of the trouble with creating packages for every target system out there?

[0] https://news.ycombinator.com/item?id=4701745

[1] https://news.ycombinator.com/item?id=6008196

[2] http://blog.classicalcode.com/2012/11/curl-pipe-sh-exploit-proof-of-concept/

[3] https://news.ycombinator.com/item?id=3315461

real examples in the wild:

    ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go)"

    curl https://install.meteor.com | /bin/sh

    bash < <(curl -s https://rvm.io/install/rvm)

    curl get.pow.cx | sh

    curl -sS https://getcomposer.org/installer | php

1 comment