I find it funny and sad at the same time that an installer for a "safe" programming language teaches people to download a shell script from a website and run it. What a farce.
back
3 comments
With cert pinning, CT, and other advancements in transport security, I don't see a huge fundamental difference between this and adding a random apt repository & doing an apt install.
You should also not add random apt repositories from the internet. But there is still a major different in terms of the implications for user education.
Why is downloading a shell script from a website and running it any less safe than downloading a package from a distro repository and running it? The owners of rustup.rs are just as unlikely to be malicious as the people who package things for Debian.
Adding a package repository is a very conscious choice that also requires a password. Cut & pasting a line of code from we website is not. This is why a lot of time and effort was spend in the past educating users not to run random code from the internet. That is may be safe in this particular specific case does not change the fact that this generally undermines the message that one should not cut&paste arbitrary code from a website into a terminal.
Read what the “safe” means. It is narrow. Memory safety.
That much is clear. It is not about safety. It is a cult around memory safety.
Your comment is substanceless.