I'm a lifelong Windows user - I usually install software by downloading installers and double clicking them.
Every so often HN rolls their eyes at all these idiots who do "curl | sh". How is doing so any different from downloading an installer over https and running it? Really, if installing software is what we're doing, isn't running it part of the objective?
Or, in short, why is "curl | sh" frowned upon and why are alternatives better?
It all comes down to trust. If you trust that the code you're downloading is good then by all means curl | sh.
A lot of things can go wrong with this though, if you pull a script from a github link and run it, the code could have been modified since you last looked at the repo and now you're directly running malicious code.
When you download an msi in Windows and then double click to install, you're also putting your trust in the website, the software author and anyone else in the supply chain.
I think the better option is downloading, manually reviewing the script you downloaded, and then running it.
If you're devops-ing something then you should probably download the script/code and then do some kind of hash or signature check to make sure it's the known good version, then run it.
Perhaps I'm misunderstanding what you're saying, but if by "execution permissions" you mean running "powershell -executionpolicy bypass" this doesn't require you to be administrator.
The only thing you need to be administrator for is to run "Set-ExecutionPolicy -Scope LocalMachine"
Permanently modifying it (using Set-ExecutionPolicy) requires admin, but from what I remember, setting it on a per-process basis by starting powershell.exe with the -ExecutionPolicy flag does not.
You actually can even permanently modify it as a normal user. You need to be admin to run set-executionpolicy -Scope LocalMachine (which is the default) but you can run set-executionpolicy -Scope CurrentUser as a normal user.
(This can be overridden by policies though.)
Also, in windows 10 the default ExecutionPolicy changed from Windows 7 so by default you can run powershell scripts even without using -executionpolicy bypass.
11 comments
[ 3.4 ms ] story [ 18.9 ms ] threadThen again all cool kids now do curl | sh anyway.
Every so often HN rolls their eyes at all these idiots who do "curl | sh". How is doing so any different from downloading an installer over https and running it? Really, if installing software is what we're doing, isn't running it part of the objective?
Or, in short, why is "curl | sh" frowned upon and why are alternatives better?
You can also check that an installer isn't corrupted sfter downloading and before running, classically withe the md5 hash.
And if one gets a random .rpm/.deb package, then it should be installed only if the digital signature is valid.
A lot of things can go wrong with this though, if you pull a script from a github link and run it, the code could have been modified since you last looked at the repo and now you're directly running malicious code.
When you download an msi in Windows and then double click to install, you're also putting your trust in the website, the software author and anyone else in the supply chain.
I think the better option is downloading, manually reviewing the script you downloaded, and then running it.
If you're devops-ing something then you should probably download the script/code and then do some kind of hash or signature check to make sure it's the known good version, then run it.
The only thing you need to be administrator for is to run "Set-ExecutionPolicy -Scope LocalMachine"
(This can be overridden by policies though.)
Also, in windows 10 the default ExecutionPolicy changed from Windows 7 so by default you can run powershell scripts even without using -executionpolicy bypass.