Should answers suggesting `curl | sh` be downvoted?

Question

When answers are given that suggest curl <url> | sh (or related variants, wget, bash etc,...) should they be down-voted?

Example: How to install NodeJS 4 on Ubuntu 15.04 64 bit edition?

From a stack-exchange quality perspective:

• these answers violate the expectation that answers should be given "on-site", not just as an external link, as the real steps for the answer are in the curl link.
• these answers become invalid when/if the link changes

From a security perspective:

• This is not a practice that should be recommended to users, most either require sudo, or eventually call sudo, thus giving the keys to the kingdom to a random URL

Answer 1

To quote Mr. Fitzgerald:

Unix was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.

Neither is Linux designed to stop users doing stupid things, means for me, If you're going do use curl or equivalent to pull a script and execute it you should know whats happening and being clever enough to check that script beforehand.

Back to your question, No, they should not be down-voted, at least for the solutions given in your example link. They are valid and probably working answers. Just to judge them by using the tools you have at hand in Linux seems simply wrong to me.

I understand that you imply that there is a security risk, and there is, but we are mature users and should use our heads beforehand. Please don't let this site and Linux become just another Windows.

Answer 2

these answers violate the expectation that answers should be given "on-site", not just as an external link, as the real steps for the answer are in the curl link.

No, they do not violate any expectation. There are disclaimers in place that content on Stack Exchange network sites doesn't guarantee validity, but there is no explicit statement that answers should be given completely on site, in fact very often it's not possible provide full steps on site.

For user protection, one could leave a comment or download code and see its contents to ensure nothing violates OP's security. It is often not possible to provide contents of the linked code due to its length or the fact that the linked binary may be compiled.

Some well known sites such as Github or Github gists can be easily opened and checked.

The concept of Buyer Beware holds true throughout the internet, and the internet has been around for quite a while now, so if OP doesn't know any better than to not check what is being provided by the link in the answer - that's their choice to some extent. As Martijn Piters said:

Our questions and answers use an open license. Anyone gets to have access to that knowledge, including people with ill intent.

However, it is not the responsibility of the Stack Exchange network as per the terms of use:

Unless explicitly otherwise provided, neither Stack Exchange nor the Network make any representation or warranty whatsoever about any third party site that is linked to the Network, or endorse the products or services offered on such site. Stack Exchange and the Network disclaim: (a) all responsibility and liability for content on third party websites and (b) any representations or warranties as to the security of any information (including, without limitation, credit card and other personal information) You might be requested to give any third party, and You hereby irrevocably waive any claim against the Network or Stack Exchange with respect to such sites and third party content. ( Section 6: Third Party Websites )

Next point:

these answers become invalid when/if the link changes

Stack Exchange, once again, is not responsible for the content of those links or their validity. It's up to the community to push the poster and say: "Hey, update your stuff" or edit the post by yourself.

From a security perspective:

This is not a practice that should be recommended to users, most either require sudo, or eventually call sudo, thus giving the keys to the kingdom to a random URL

As per the terms of use that were mentioned above, it is illegal to post content that violates security/integrity of computer systems . If you do find those links pose probable security risk, contact a moderator and explain the situation, and leave comments. Downvote the post if you so choose. That's the best that can be done from regular-user point of view.

Otherwise, there is no reason to criticize post that has valid steps listed just because it uses wget or curl. wget or curl are no different from downloading items by yourself, with only difference that content is being passed to the shell or whatever else. Again, I cannot stress this enough: Buyer beware.