Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

A nice visible reason why the Rails/Node/OSX FOSS community really need to stop doing the following sort of thing for their installations (seen most recently on yeoman.io, but common to get.pow.cx, npm...)::

curl get.totallytrustworthyapp.io | bash

The above examples are obviously legit, but encouraging this kind of lazy access to even local privileges from arbitrary remote scripts (and Yeoman even asks for sudo in a super-friendly way), is the modern equivalent of padlock.gif on your payment page - training poor security practices.



You're still ultimately going to be running some code without reading all of it first, aren't you?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: