Linux

What's stopping the downloaded script from wiping my home directory?

What's stopping any Makefile, build script, or executable from running rm -rf ~? The correct answer is "nothing". PPAs are similarly open, things are a little safer if you only use your distro's default package sources, but it's always possible that a program will want to be able to delete something in your home directory, so it always has permission.

Containerized apps are the only way around this, where they get their own home directory.

For security reasons, I review every line of code before it’s executed on my machine.

Before I die, I hope to take my ‘93 dell optiplex out of its box and finally see what this whole internet thing is about.

It isn’t more dangerous than running a binary downloaded from them by any other means. It isn’t more dangerous than downloaded installer programs common with Windows.

TBH macOS has had the more secure idea of by default using sandboxes applications downloaded directly without any sort of installer. Linux is starting to head in that direction now with things like Flatpak.

If you're worried, download it into a file first and read it.

What's stopping the downloaded script from wiping my home directory?

Lol. Lmao

The security concerns are often overblown. The bigger problem for me is I don't know what kind of mess it's going to make or whether I can undo it. If it's a .deb or even a tarball to extract in /usr/local then I know how to uninstall.

I will still use them sometimes but for things I know and understand - e.g. rustup will put things in ~/.rustup and update the PATH in my shell profile and because I know that's what it does I'm happy to use the automation on a new system.

You could just read the script file first.. Or YOLO trust it like you trust any file downloaded from a relatively safe source.. At least you can read a script.

This is just normal Linux poor security. Even giants like docker do this.

Back up your data folks. You're probably more likely to accidentally rm -rf yourself than download a script that will do it.

| sh stands for shake head at bad practices

When I modded some subreddits I had an automod rule that would target curl-bash pipes in comments and posts, and remove them. I took a fair bit of heat over that, but I wasn't backing down.

I had a lot of respect for Tteck and had a couple discussions with him about that and why I was doing that. I saw that eventually he put a notice up that pretty much said what I did about understanding what a script does, and how the URL you use can be pointed to something else entirely long after the commandline is posted.

I dont just cringe, I open a bug report. You can be the change to fix this.

And don't forget to sudo!

What does curl even do? Unstraighten? Seems like any other command I’d blindly paste from an internet thread into a terminal window to try to get something on Linux to work.