Stop piping install scripts to bash
So help me God if I see one more curl -fsSL https://trustme.bro/install.sh | bash. Looking at you Claude Code.
The title is a smidge hyperbolic; there's nothing inherently unsafe with curl/wget, sub-shells, and a lil vertical bar. Hell, it's functionally equivalent to copy/pasting commands into your shell.
My concern is rooted in trust boundaries. You give a web resource (the downloaded script) full access to the current environment and privileges. Even worse, the pipe means you don't see what's running.
You know what's worse than curl | bash? sudo curl | bash. Don't run anything untrusted as root.
Software installation is broadly composed of 2 phases
- Acquire artifacts
- Store artifacts
Package managers conveniently handle both, as can arbitrary install scripts, however they differ in trust patterns and attestation. I reasonably trust packages installed via apt, pacman, or to a lesser extent brew (improved by tap trust introduced in 6.0.0) to be sourced from reputable servers and have undergone sufficient review and auditing. A random series of shell commands, in contrast, is placing a whole lot of trust someone didn't sneak in a funny rm -rf ~ or download a binary from an unexpected domain.
By the time you run arbitrary software, you're at the mercy of other actors. Arguably, trust in a server/domain spans all its resources, whether that be an install script or software artifacts.
I posit install scripts have higher risk due to immediate execution. A compromised release isn't an issue until you run the software (ignoring things like systemd timers and services). Furthermore, install scripts are not commonly versioned so you may not be aware of what you've ever run.
The fix
Regrettably I have no solution to stay truly "safe" (by your definition of choice) when running 3rd party software. You're always running someone else's code after all, but we can try to keep the install portion clean.
At minimum, manually vet install scripts. Even with provider trust, I may want to know what opinionated system mutations an install may induce. I personally look out for anything touching my .zshrc (NEVER touch my .zshrc) and reversibility of the install.
Promote tech literacy and shame practitioners of unsafe patterns.