Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What difference does it make if you run `make install` or `curl | bash`? In both cases, you are running code you have not audited yourself. Or are you the kind who inspects every Makefile and installer script before installing? If not, why is one better than the other?


Because at least with make install you can have some trust in the delivery method, ie encrypted git or whatever. If you use just plain http....


So wget https://example.com/installer.tar.gz; tar -xvzf installer.tar.gz; cd installer; make install is okay for you?

But curl https://example.com/installer.sh | bash is not? Why?


I'm fine with the second too as long as the host is trustworthy and it's always https. Most of the time it isn't.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: