How the alternatives are better than using curl | sudo sh How the alternatives are better than using curl | sudo sh curl curl

How the alternatives are better than using curl | sudo sh


The significant difference is the use of less. The quote prompts you to check the contents of the file you have downloaded. This is necessary, because the code is not signed. A package manager uses signatures to trust the sources. It is important to check the contents, because it is not secure to pipe something from a web server directly into your shell. See here how to exploit it here for a description.


https://www.idontplaydarts.com/images/bashmov.gif

shell-redirection can apparently be detected at the server side, and a normal script can be delivered upon normal inspection and a malicious payload be delivered upon sh redirection, so at least you'll avoid that issue, this website explains it much better than i can: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/