It would be fun to build a list of projects that install this way, then build a tool that sits on open WiFi networks and automatically tacks on a "fun" payload whenever it sees someone request one of these scripts.

> to be more constructive: would you accept contributions to build packages? Apart from this annoyance the project looks interesting!

Of course any contribution of this kind is greatly appreciated !

How do you install new stuff on your machine without super user rights ? Do you have a specific user to run apt-get ?

apt-get doesn't run unsigned, unvetted shell scripts downloaded over unprotected channels.

About the signing part, we definitely have to improve that. Thank you for mentioning.

About the channel, the (real) install script is based on Fabric and use SSH. So you can refer directly to this: http://cozy.io/host/install.html

You also should be using HTTPS for these sort of situations.

Not that what you are suggesting is good in the first place.

Signed packages have at least two advantages:

1. they can be signed

2. they can be analyzed (also at a later date if you keep them around) to figure out if any "mis-feature" was added after the fact or came from upstream. Those scripts typically download all kinds of other things during the installation.

Thank you for your feedback, we'll fix that. I open an issue about it.

I think it might have to do with http vs https.