Search code examples
curlsudo

Why using curl | sudo sh is not advised?


While I was reading the introduction to the Rust programming language, I came across the installation method which asks to use the following command

curl -sf -L https://static.rust-lang.org/rustup.sh | sudo sh

with a note of caution that this is not the most trusted way of installing an application. Can anybody provide me the details about how this command can be dangerous and are there any methods to protect yourself from its effects?


Solution

  • Because you are giving root access to whatever script you are executing. It can do a wide variety of nasty things.

    If Rust site is ever compromised and that script gets a tiny piece that installs malware silently, you wouldn't know, without inspecting the script first.