Can anyone explain the following trend to me? I've been seeing it alot lately:
On the install page [0] the installation instructions tell people to run this command:
curl https://static.rust-lang.org/rustup.sh | sudo bash
This seems to me to be an extremely bad idea. Why would I want to pipe arbitrary commands into my shell? Even worse, the shell has to run with root priveleges? Does anyone actually do this? Am I overthinking it?
Of course, I can verify the contents of the script, but I still don't know that the script I've verified on their website is the script that's being run in my shell. Is it OK because the script is hosted over https, and therefore can't be modified on transmission?
Of course, I can verify the contents of the script, but I still don't know that the script I've verified on their website is the script that's being run in my shell. Is it OK because the script is hosted over https, and therefore can't be modified on transmission?
[0]https://crates.io/install