The official Node docs recommend piping an internet script straight to bash (we never learn)
never learn what exactly? you’re about to execute a bunch of arbitrary code downloaded from the internet anyway, why does is matter if the first chunk is a shell script?
It has been a long-running mistake to get programmers used to piping arbitrary commands from the internet directly into their shell. Quite a few developer-targeting malware activities rely on devs being willing to use this pattern.
never learn what exactly? you’re about to execute a bunch of arbitrary code downloaded from the internet anyway, why does is matter if the first chunk is a shell script?
score 1 · canonical
It has been a long-running mistake to get programmers used to piping arbitrary commands from the internet directly into their shell. Quite a few developer-targeting malware activities rely on devs being willing to use this pattern.
score 1 · canonical
Can you name a real example?
score 1 · canonical
I Googled “brew upgrade” and Found a Malware Operation, although I’ll concede that’s still a very easy one to spot if we’re talking about developer-targeting.
score 1 · canonical