

Most developers I’ve looked at would happily just paste the curl|bash thing into the terminal.
I mean, I typically see it used for installing applications, and so long as TLS is used for the download, I’m still not aware of a good reason why you should check the Bash script in particular in that case, since the application itself could just as well be malware.
Of course, it’s better to check the Bash script than to not check it, but at that point we should also advise to download the source code for the application, review it and then compile it yourself.
At some point, you just have to bite the bullet and I have not yet seen a good argument why the Bash script deserves special treatment here…
Having said that, for cases where you’re not installing an application, yeah, reviewing the script allows you to use it, without having to trust the source to the same degree as you do for installing an application.




















It’s kind of bad for scripts, where it can be either annoying or genuinely problematic, when your script hangs on a password prompt. You typically do want it to just fail right away, because if you have monitoring, then you’ll be able to spot it failing.
These days, it is (largely reliably) possible to detect whether a command is being run interactively or as part of an unattended script, so you do see some commands that trigger a sudo password prompt only for interactive use, for example
systemctldoes this. But this adds quite a bit of complexity to each individual program, so it isn’t really something that’s going to be implemented universally.I also have to say that
systemctlkind of gets on my tits when it does that, because it throws up a GUI dialog for grabbing the password, which is quite jarring.