<story><title>Asciinema</title><url>https://asciinema.org/</url></story><parent_chain><item><author>DyslexicAtheist</author><text>piping random shit into sh is wrong because domains go away, yet installation instructions might be repeated in countless other tutorials. easy to snap up domains and host malware.&lt;p&gt;and SSL has nothing to do with it. packages are not cryptographically signed either and once on the system can easily become root.</text></item><item><author>reagency</author><text>What&amp;#x27;s wrong with that? It is SSL secured.&lt;p&gt;Once you agree to install software, it had local access with your accounts privileges.</text></item><item><author>Thaxll</author><text>Seriously when people will stop using that for installation....&lt;p&gt;&amp;quot;curl -sL &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;asciinema.org&amp;#x2F;install&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;asciinema.org&amp;#x2F;install&lt;/a&gt; | sh&amp;quot;&lt;p&gt;Still a cool product!</text></item></parent_chain><comment><author>joefreeman</author><text>Would this be better if the pasted command included some checksum which was checked before piping into the `sh`? Can anyone who&amp;#x27;s better at bash than me give an example of how this could work in a relatively cross-platform way?</text></comment>
<story><title>Asciinema</title><url>https://asciinema.org/</url></story><parent_chain><item><author>DyslexicAtheist</author><text>piping random shit into sh is wrong because domains go away, yet installation instructions might be repeated in countless other tutorials. easy to snap up domains and host malware.&lt;p&gt;and SSL has nothing to do with it. packages are not cryptographically signed either and once on the system can easily become root.</text></item><item><author>reagency</author><text>What&amp;#x27;s wrong with that? It is SSL secured.&lt;p&gt;Once you agree to install software, it had local access with your accounts privileges.</text></item><item><author>Thaxll</author><text>Seriously when people will stop using that for installation....&lt;p&gt;&amp;quot;curl -sL &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;asciinema.org&amp;#x2F;install&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;asciinema.org&amp;#x2F;install&lt;/a&gt; | sh&amp;quot;&lt;p&gt;Still a cool product!</text></item></parent_chain><comment><author>sebastianavina</author><text>If you are doing a terminal video, I&amp;#x27;m pretty sure you are smart enough to break down that pipe and first download, and then run it.</text></comment>