> If you access a web application, you end up re-downloading the application from the server thousands of times, and you are fully trusting the server each time. If the server gets hacked even one of the thousands of times that you open the site, you might be screwed. Regular old-fashioned applications (where you explicitly click "download") are better than this: you only need to trust the server to not be malicious or hacked at that exact moment once.
That's precisely why something like signed distributions packages are way more secure than curl bash'ing.
But many simply don't understand that. We had plenty of forged Web certificates likely. And even without that, with curl bash'ing anything sensitive you have to cross fingers that the server ain't serving one in 10 000 request with a backdoored version.
With curl bash'ing everybody is trusting every single time that the server ain't compromised or intentionally malicious.
At this point I've lost any hope: people simply don't understand security.
And as long as we'll have people saying that curl bash'ing is just as safe as signed distros packages, we'll have daily posts about major security incidents.
Security is a mindset and most people simply don't have it.
That's precisely why something like signed distributions packages are way more secure than curl bash'ing.
But many simply don't understand that. We had plenty of forged Web certificates likely. And even without that, with curl bash'ing anything sensitive you have to cross fingers that the server ain't serving one in 10 000 request with a backdoored version.
With curl bash'ing everybody is trusting every single time that the server ain't compromised or intentionally malicious.
At this point I've lost any hope: people simply don't understand security.
And as long as we'll have people saying that curl bash'ing is just as safe as signed distros packages, we'll have daily posts about major security incidents.
Security is a mindset and most people simply don't have it.