On piping Curl to apt-key

Wouldn't it already help if apt-key printed the list of keys it imported instead of the absolutely superfluous "OK"?

On piping anything from the Internet directly to your system for execution: Don't be lazy. Don't be an ass.

When I am working in a persona that responsible for managing a server or a service, I insist on knowing everything I need to know about how to keep that service and the environment in which it operates safe, alive, and providing usable performance.

I require good, clean and coherent instructions for deploying something at production level, where all required components and their preferred method of interaction are clearly explained and documented by the developer, and can be repeated in a predictable manner by me.

If all I have to work with is "pipe this to the shell, alternatively read the code" I'm going to go with "nah, I'll find something professional".

Time spent installing a system should be only a minuscule fraction of time spent actually operating the system. Spending a few extra hours doing it right shouldn't make a difference.

[edit: added "...and another thing" argument]

I hate this practice, no idea how it became commonplace. Of course lots of times, installation procedures can be long and tedious, but it takes one popular project's script server to be compromised, and tons of people are suddenly running malicious commands.

I would go through manually installing dependencies and setting up my system, adding repos, etc. over running some script any day. But then again some projects wouldn't be that popular if they were hard to install.

Some of npm's installation instructions ask you to pipe curl into bash, to run a lovely script [0] which makes things easier for you, but not by much. Is it really necessary? Would developers give up trying to get npm and node just because installing not as easy as "curl https://some.script.com/that-script.sh | sudo -E bash -; sudo apt-get install npm"?

Other than building/installing programs, adding GPG/SSH keys like in the blog post can be as dangerous, and while not simple, there could be some method built to make things easier without having to run commands you don't even check.

Anyways, hope projects grow out of this habit.

[0] https://deb.nodesource.com/setup_6.x

Or just an extra flag like --list-after-import.

Isn't the solution to publish the key on a keyserver and fetch it with apt-key? Something like

    apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys