I was going to try out Rust, then I saw this on the download page
curl https://sh.rustup.rs -sSf | sh
back
2 comments
Yes.
The script is less than 400 lines, and is pretty easy to audit. We wrote it in such a way to prevent some issues like "if the download gets cut off only part of the script gets run." It's served over HTTPS.
You can also probably get an install from whatever package manager you use, if you prefer that.
You can detect whether the script is being piped into sh, so downloading the script via for example FF might produce different results than piping it to shell, making audits useless.
Sure. If you're worried about that, it's easy enough to download it first, and then run it, without the pipe.
If you're auditing it, you've already downloaded it, so it's unclear to me why you'd re-download and pipe rather than just running it.
You still have zero guarantee that other people are getting the same code.
Encouraging people to run code from some random URL on the Internet is always bad.
I've been looking at Rust recently, and my conclusion is that it is not production-ready.
It seems like an ever-changing work in progress at the moment, with idiosyncrasies such as this.