-3

When answers are given that suggest curl <url> | sh (or related variants, wget, bash etc,...) should they be down-voted?

Example: How to install NodeJS 4 on Ubuntu 15.04 64 bit edition?

From a stack-exchange quality perspective:

  • these answers violate the expectation that answers should be given "on-site", not just as an external link, as the real steps for the answer are in the curl link.
  • these answers become invalid when/if the link changes

From a security perspective:

  • This is not a practice that should be recommended to users, most either require sudo, or eventually call sudo, thus giving the keys to the kingdom to a random URL
4

2 Answers 2

13

To quote Mr. Fitzgerald:

Unix was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.

Neither is Linux designed to stop users doing stupid things, means for me, If you're going do use curl or equivalent to pull a script and execute it you should know whats happening and being clever enough to check that script beforehand.

Back to your question, No, they should not be down-voted, at least for the solutions given in your example link. They are valid and probably working answers. Just to judge them by using the tools you have at hand in Linux seems simply wrong to me.

I understand that you imply that there is a security risk, and there is, but we are mature users and should use our heads beforehand. Please don't let this site and Linux become just another Windows.

2
  • 2
    Basically it all comes down to the last paragraph. People should user their head Jul 13, 2016 at 7:01
  • I can't say I follow or understand this "not Windows" logic. Perhaps on other distros, but "linux for human beings" is about not expecting users to be developers. Perhaps my example was for programmers (nodejs), but look for others like "Intel graphics drivers" or other non-programmer user questions you find the same.
    – Greg
    Jul 18, 2016 at 2:11
10

these answers violate the expectation that answers should be given "on-site", not just as an external link, as the real steps for the answer are in the curl link.

No, they do not violate any expectation. There are disclaimers in place that content on Stack Exchange network sites doesn't guarantee validity, but there is no explicit statement that answers should be given completely on site, in fact very often it's not possible provide full steps on site.

For user protection, one could leave a comment or download code and see its contents to ensure nothing violates OP's security. It is often not possible to provide contents of the linked code due to its length or the fact that the linked binary may be compiled.

Some well known sites such as Github or Github gists can be easily opened and checked.

The concept of Buyer Beware holds true throughout the internet, and the internet has been around for quite a while now, so if OP doesn't know any better than to not check what is being provided by the link in the answer - that's their choice to some extent. As Martijn Piters said:

Our questions and answers use an open license. Anyone gets to have access to that knowledge, including people with ill intent.

However, it is not the responsibility of the Stack Exchange network as per the terms of use:

Unless explicitly otherwise provided, neither Stack Exchange nor the Network make any representation or warranty whatsoever about any third party site that is linked to the Network, or endorse the products or services offered on such site. Stack Exchange and the Network disclaim: (a) all responsibility and liability for content on third party websites and (b) any representations or warranties as to the security of any information (including, without limitation, credit card and other personal information) You might be requested to give any third party, and You hereby irrevocably waive any claim against the Network or Stack Exchange with respect to such sites and third party content. ( Section 6: Third Party Websites )

Next point:

these answers become invalid when/if the link changes

Stack Exchange, once again, is not responsible for the content of those links or their validity. It's up to the community to push the poster and say: "Hey, update your stuff" or edit the post by yourself.

From a security perspective:

This is not a practice that should be recommended to users, most either require sudo, or eventually call sudo, thus giving the keys to the kingdom to a random URL

As per the terms of use that were mentioned above, it is illegal to post content that violates security/integrity of computer systems . If you do find those links pose probable security risk, contact a moderator and explain the situation, and leave comments. Downvote the post if you so choose. That's the best that can be done from regular-user point of view.

Otherwise, there is no reason to criticize post that has valid steps listed just because it uses wget or curl. wget or curl are no different from downloading items by yourself, with only difference that content is being passed to the shell or whatever else. Again, I cannot stress this enough: Buyer beware.

4
  • 3
    (Caveat emptor)
    – muru
    Jul 13, 2016 at 14:53
  • Can you clarify here then - there is definitely complaint when people answer questions with URLs. Is the difference the difference between a comment asking for an actual answer vs a down-vote?
    – Greg
    Jul 18, 2016 at 2:12
  • Say you a have car break down and you come to your friend for help. You know nothing about cars. He takes out from garage some kind of part and says:"Here, that's what you want". Same with URL only links. Different situation is when your friend says " You need to take this part, it's located here and here, and you will need to unscrew this and this ". Downvote is like saying to your friend "WTF, no!". Asking for clarification is like saying " ok, what do i do with this part? Please explan because i don't know about cars" Jul 18, 2016 at 3:05
  • @Greg posting an answer with a URL or two is fine. Posting an answer with only a URL or two is not. We encourage people to source their content if they found it elsewhere. However, we discourage people only putting links, as sites can go down. If something has to be linked, include as much as possible in the answer to others coming later might still be able to find the linked content even if the link dies. Jul 19, 2016 at 3:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .