请大家停止使用 curl | sudo bash，好吗？
使用 `<p>curl -s https://url | sudo bash<p>` 这种方式简直是疯狂。给予了根权限。我们知道账户是如何被攻破的，因此显然有可能这个网址会被黑客替换成恶意内容。我们甚至见过黑客入侵页面，返回标准页面，同时只针对少数人（例如地理位置）发送恶意数据。
然而，也有可能返回的是格式错误的文本。Bash 会乐意执行每一行代码，例如：
```
E#@%SDVsdcvxdsf4a6t4g
erfgrr;rm * regdfgereridbd
4524wfasrfv4
```
很难想象这样的输出？是的。不可能吗？绝对不是。在典型的 Linux 安装中，Bash 可以访问成千上万的命令，其中许多是具有破坏性的。为什么还要冒这个险呢？
除了格式错误之外，可能还会出现简单的发布错误。错误信息中可能包含代码行。未知文本。每一行返回的文本都会被执行。我简直无法相信这种情况在任何地方、出于任何原因都存在。我甚至不会在我自己的个人网络服务器上执行这样的命令，更不用说远程了。
当我在项目页面上看到这样的荒谬时，这对我来说是一个巨大的警示信号。便利性胜过最基本的安全性，甚至连简单的验证都没有，确保 curl 请求没有出错。由此产生的不信任感如同喉咙中的胆汁，项目作者采取了什么其他捷径，似乎对最基本的风险评估几乎一无所知？
请，永远不要执行这个。如果你不得不抛弃所有的理智和谨慎，使用一个建议这种安装方法的项目……那么，至少用 `curl > file` 并花一秒钟查看结果。
查看原文
Using<p>curl -s https://url | sudo bash<p>is literal insanity. Root given. We know how accounts can be compromised, so obviously there is potential for that url to be replaced by a hacker with something malicious. We've even seen hackers compromise pages, and return the standard page, while targetting only a few people (geolocation, for example) with malicious data.<p>Yet there is also the possibility for malformed text to be returned. Bash will happily execute each and every line of:<p><pre><code> E#@%SDVsdcvxdsf4a6t4g
erfgrr;rm * regdfgereridbd
4524wfasrfv4
</code></pre>
Hard to imagine such output? Yes. Impossible? Absolutely not. There are literally thousands upon thousands of commands bash can access in a typical install of Linux. Many of them are destructive. Why even risk it?<p>And beyond malformed, there could be a simple publishing error. There could be lines of code in the error message. Unknown text. Each and every line of text returned, is executed. I am just gobsmacked that this exists anywhere, ever, for any reason at all. I wouldn't execute such a command from my own personal web server, in my own internal lan, let alone remote.<p>When I see such inanity on a project page, it's a big read flag to me. Convenience over the most basic of security, or even simple validation that something didn't go wrong in a curl request. The evoked lack of trust that arises is as bile in my throat, what other shortcuts are taken by the project authors, which seem to barely understand the simplest of risk assessment?<p>Please, don't ever execute this. If you have to throw all sense and caution to the wind, and use a project which suggests this install method, well... at least curl > file and take 1 second to see the result.