True enough... but even then, you can download and review the script before running. Usually it just detects your OS/Distro and then downloads and runs the appropriate installer. You can also do this by hand.
For that matter, there's always a risk of downloading/installing anything from anywhere. There have been successful compromises of many application supply chains at this point in official release paths. You will accept some risk regardless of your approach.
I don't think so, the risk level is different. Pipe an unreviewed bash script from a URL is red flag, downloading an app from Apple App Store is safer. There are many other examples, I just want to tell: the risky level is not the same, each person has different take.
Comments
but people pipes a shell script from a URL to bash all the time. with enough practices, it becames second nature.
True enough... but even then, you can download and review the script before running. Usually it just detects your OS/Distro and then downloads and runs the appropriate installer. You can also do this by hand.
For that matter, there's always a risk of downloading/installing anything from anywhere. There have been successful compromises of many application supply chains at this point in official release paths. You will accept some risk regardless of your approach.
I don't think so, the risk level is different. Pipe an unreviewed bash script from a URL is red flag, downloading an app from Apple App Store is safer. There are many other examples, I just want to tell: the risky level is not the same, each person has different take.