Re: `curl | sh` (was Re: [ann] Blog post on Luvit without Luvit)

[Rena <hyperhacker@...>]

On Fri, May 6, 2016 at 4:18 PM, Tim Caswell <tim@creationix.com> wrote:

Also it does appear that people feel more comfortable downloading a binary (I can add hash sums on the website if people bother to verify).

From best to worst:

* Downloading source with hashes

* Downloading source with no hashes

* Downloading a binary with hashes

* Downloading a binary with no hashes

* Piping from the web directly into a shell

A binary is still pretty difficult to read.