Mildly Infuriating

It's bad practice to do it, but it makes it especially easy for end users who already trust both the source and the script.

On the flip side, you can also just download the script from the site without piping it directly to bash if you want to review what it's going to do before you run it.

Installing Rust: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh (source)
Installing Homebrew: /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" (source)

I understand that you find it infuriating, but it's not something completely uncommon, even in high end projects :/

Would you prefere

$ curl xyz
$ chmod +x xyz
$ ./xyz

?

I've seen a lot of projects doing this lately. Just run this script, I made it so easy!

Please, devs, stop this. There are defined ways to distribute your apps. If it's local provide a binary, or a flatpak or exe. For docker, provide a docker image with well documented environments, ports, and volumes. I do not want arbitrary scripts that set all this up for me, I want the defined ways to do this.

I agree but hey at least you can inspect the script before running it, in contrast to every binary installer you're called to download.

I'm gonna go out on a limb and say you find this more than mildly infuriating.

You really should use some sort of package manager that has resistance against supply chain attacks. (Think Linux distros)

You probably aren't going to get yourself in trouble by downloading some binary from Github but keep in mind Github has been used for Malware in the past.

That's becoming alarmingly common, and I'd like to see it go away entirely.

Random question: do you happen to be downloading all of your Kindle books? 😜

What's that? A connection problem? Ah, it's already running the part that it did get... Oops right on the boundary of rm -rf /thing/that/got/cut/off. I'm angry now. I expected the script maintainer to keep in mind that their script could be cut off at litterally any point... (Now what is that set -e the maintainer keeps yapping about?)

Can you really expect maintainers to keep network error in mind when writing a Bash script?? I'll just download your script first like I would your binary. Opening yourself up to more issues like this is just plain dumb.

I'm with you, OP. I'll never blindly do that.

Also, to add to the reasons that's bad:

• you can put restrictions on a single executable. setuid, SELinux, apparmor, etc.
• a simple compromise of a Web app altering a hosted text file can fuck you
• it sets the tone for users making them think executing arbitrary shell commands is safe

I recoil every time I see this. Most of the time I'll inspect the shell script but often if they're doing this, the scripts are convoluted as fuck to support a ton of different *nix systems. So it ends up burning a ton of time when I could've just downloaded and verified the executable and have been done with it already.

I'll do it if it's hosted on Github and I can look at the code first but if it's proprietary? Heck no

You are being irrational about this.

You're absolutely correct that it is bad practice, however, 98% of people already follow bad practice out of convenience. All the points you mentioned against "DoWnlOADing a BinAary" are true, but it's simply what people do and already don't care about.

You can offer only your way of installing and people will complain about the inconvenience of it. Especially if there's another similar project that does offer the more convenient way.

The only thing you can rationally recommend is to not make the install script the "recommended" way, and recommend they download the binaries from the source code page and verify checksums. But most people won't care and use the install script anyway.

If the install script were "bloody pointless", it would not exist. Most people don't know their architecture, the script selects it for them. Most people don't know what "adding to path" means, this script does it for them. Most people don't know how to install shell completions, this script does it for them.

You massively overestimate the average competence of software developers and how much they care. Now, a project can try to educate them and lose potential users, or a project can follow user behavior. It's not entirely wrong to follow user behavior and offer the better alternatives to competent people, which this project does. It explains that it's possible and how to download the release from the Github page.

tbf, every time you're installing basically anything at all, you basically trust whoever hosts the stuff that they don't temper with it. you're already putting a lot of faith out there, and i'm sure a lot of the software actually contains crypto-mineware or something else.

I assume your concern is with security, so then whats the difference between running the install script from the internet and downloading a binary from the internet and running it?

I saw many cases of this with windows PowerShell and those Window debloating scripts

I'll die on the hill that curl | bash is fine if you're installing software that self updates - very common for package managers like other comments already illustrated.

If you don't trust the authors, don't install it (duh).

They should really put the npm installation first

Can you actually explain what concerns you have, that wouldnt be any more of a concern if you downloaded and installed a binary directly?

At least a shell script you can read in plaintext, a binary can just do who the fuck knows what.

I wouldn't call anyone who does this, a developer. No offense, but its a horrible practice, that usually come from hacky projects.