41–50 of 100 posts
I know it's not popular to care about these things these days, but please consider a different installation mechanism than curl piped into sudo bash. It's irresponsible and normalizes a practice that never should've happened.
Can we stop with this nonsense already? If you trust them enough to run their server code, why wouldn't you trust them with the installation script?
Earlier quoted context omitted.
Can we stop with this nonsense already? If you trust them enough to run their server code, why wouldn't you trust them with the installation script?
I don’t trust them enough to run as root.
I know it's not popular to care about these things these days, but please consider a different installation mechanism than curl piped into sudo bash. It's irresponsible and normalizes a practice that never should've happened.
Installation via package managers (Debian/Ubuntu), using repo provided by ferron
https://ferron.sh/docs/installation/debian
Installation as a Docker container
https://ferron.sh/docs/installation/docker
And more.
There is something funny going on in the benchmarking section. If you look at the charts, they don't benchmark the same servers in 4 examples. Each of the 4 charts have data for Ferron and Caddy, but then include data for lighttpd, apache, nginx and traefik selectively for each chart, such that each chart has exactly four selected servers. That doesn't inspire confidence.
> Any feedback is welcome! Read https://www.joelonsoftware.com/2006/12/09/simplicity/ and ask yourself if you are truly solving anyone's problem or if you are just looking for a way to rationalize the amount of time you are spending on a hobby.
Earlier quoted context omitted.
Can we stop with this nonsense already? If you trust them enough to run their server code, why wouldn't you trust them with the installation script?
Because untrustworthy websites can piggyback on the brand name. "Download ffmpeg here: sudo bash -c ..." And then the installation script from our malicious site installs ffmpeg just fine, plus some stuff you have no idea about. And you never know that you've just been hacked.
There’s not really a difference between curl piped to bash, and installing packages from a third-party package repository that the distro maintainers have no involvement in with.
Earlier quoted context omitted.
I don’t trust them enough to run as root.
But you have to. Nginx, caddy, traefik, etc cannot run without root or even if you can, it would be way more limiting
On Linux you can allow your program to bind to those ports even without running the program itself as root.
https://superuser.com/questions/710253/allow-non-root-proces...
I know it's not popular to care about these things these days, but please consider a different installation mechanism than curl piped into sudo bash. It's irresponsible and normalizes a practice that never should've happened.
Can we stop with this nonsense already? If you trust them enough to run their server code, why wouldn't you trust them with the installation script?
I know it's not popular to care about these things these days, but please consider a different installation mechanism than curl piped into sudo bash. It's irresponsible and normalizes a practice that never should've happened.
They do offer other installation methods already. Installation via package managers (Debian/Ubuntu), using repo provided by ferron https://ferron.sh/docs/installation/debian Installation as a Docker container https://ferron.sh/docs/installation/docker And more.