alt Hacker NewsThe pattern of piping an arbitrary script to your shell? This should be an ordinary app bundle to drop into /Applications, or be distributed as an installer.
The readme even says so itself:
> A bad curl | sh, a sketchy npm install, or one of the AI agents now running in your editor with your full permissions.
And then, two paragraphs down, it suggests to do just that to install…
Replies
QuantumNomad_ • today at 7:29 AM
But it’s not piping a script into the shell. It’s curl downloading a compressed archive and piping it to tar to decompress the program binary from the archive. Then moving the extracted binary into /usr/local/bin.
hackernudes • today at 7:27 AM
Technically this one is piping it to tar? But I agree with the sentiment.
vlaaad • today at 7:30 AM
It's curl | tar, not curl | sh
It's not piped to a shell, but to the tar program with specific parameters to directly unpack the tar.
You're still installing the program directly from github of course, instead of a source where hopefully a third party has also looked at it (like a package repository). But this is a lot better than the curl | sh pattern.