I'm not sure that curl | sh is a "broken paradigm" -- no more broken than than running JavaScript in a browser. The only difference between the two is in the sandboxing. The solution I'm proposing isn't to add Windex,…
The proper alternative is some sort of lightweight virtualization like Docker, with a proper security policy in place. You can mostly do this today curl <blah> | docker run --rm -t -i ubuntu sh but the containerizing…
I'm not sure that curl | sh is a "broken paradigm" -- no more broken than than running JavaScript in a browser. The only difference between the two is in the sandboxing. The solution I'm proposing isn't to add Windex,…
The proper alternative is some sort of lightweight virtualization like Docker, with a proper security policy in place. You can mostly do this today curl <blah> | docker run --rm -t -i ubuntu sh but the containerizing…