Why `curl | bash` is the wrong default
The install instructions for rustup, Homebrew, nvm, Docker, most Kubernetes tooling, most observability agents, and thousands of smaller projects share a single opening line: 1curl -sSL https://example.com/install.sh | sudo bash Most operators run it. Most operators know, dimly, that they probably shouldn’t. This series is about what “probably shouldn’t” actually means, and about a workflow that gives you the convenience of a one-liner without the trust-me-bro leap of faith. NIS2 · Article 21(2)(d) Supply-chain security. Regulators expect controls over software acquisition — unverified curl | bash is exactly the failure mode Article 21(2)(d) was written about. What can actually go wrong Four failure modes, ordered by realism. None of them are hypothetical. ...