Post #1251365
2026-04-07 15:54 UTC
... in combination with the fact that https://claude.ai/install.sh installs an opaque binary from a Google Storage bucket and executes it?
Replies (2)
-
@xahteiwi@mastodon.social 2026-04-07 16:04
To clarify what I mean: the vendor has chosen not to put its software under a copyleft license, which means they have not undertaken a legal obligation to give you source code that matches your binary. They're also not giving you a means to verify the binary that's in that Google Storage bucket, except using a checksum that is *also* in that bucket. So it would seem like you have no way to tell that the software in the binary has anything to do with the code in the repo.
-
@davep@infosec.exchange 2026-04-07 16:01
@xahteiwi https://claude.ai/inshallah.sh Shirley?