Seems like make?
Show HN: Oya – New projects set up lightning fast
61–70 of 111 posts
Re: Show HN: Oya – New projects set up lightning fast
#62> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
If their GitHub account gets hacked, so do their customers. What's the fundamental difference?
You have the download at github and the checksum at you webserver. Same effort, but now attackers would have to have both services compromised to plant a malicious download.
Re: Show HN: Oya – New projects set up lightning fast
#63> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
Security concerns aside, a misconfigured gateway in between (say, they use Cloudflare) can easily result in an “HTML” response being piped to my bash. The f-ing mess it could create in my home directory is unimaginable.
Really. I didnt know that was realistically possible. Do you have an example payload to create such a mess?
Re: Show HN: Oya – New projects set up lightning fast
#64My company definitely has a use-case for something like this. We are currently working on an internal product to easily set up new projects, whether they are java, ruby, lambdas, etc. We are using/abusing yeoman to do this, but yeoman was not intended to be used in a pipeline initialized from a web ui. A second issue we have is a blossoming of scripts. Some have multiple bash scripts. Some have started using makefiles.
This seems to be exactly what we could be using but I don't see a clear explanation of how it provides the initial value over something like Yeoman, and how it provides the lasting value over things like bash scripts or makefiles.
Re: Show HN: Oya – New projects set up lightning fast
#65> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
I recall two other popular projects doing the curl xyz| bash approach Rust[0] Chef [1] And here is an old HN comment[2] going into why it doesn't really matter. Besides it's a Show HN- why be negative when we can raise the same issue more constructively as "Please add checksums and digital signatures. Also why not use regular GitHub releases in the installation instructions?" [0] https://doc.rust-lang.org/book/ch01-0…
RVM requires GPG keys which is the way to do it properly: https://rvm.io/
Re: Show HN: Oya – New projects set up lightning fast
#66There’s too much obfuscation of what this software does. “New projects set up lightning fast” makes me think this is a generator framework like https://yeoman.io/ but the examples show an abstraction around bash snippets for running tasks. It does seem to do both things but only after a bit of digging; and it’s still not clear what kind of experience I’ll have using packs. To make the homepage compelling, I suggest;…
Yeoman was my first thought as well when I've scroll through that website :)
Re: Show HN: Oya – New projects set up lightning fast
#67Earlier quoted context omitted.
Since it's HTTPS, a signature or checksum are pretty pointless, TLS will do the certificate checking and encryption for you. Your assertion that "if your server gets hacked, so do your customers", also applies to a checksum, as the hackers would just change the checksum listed on the website. If you have a problem with piping curl to bash, then you can just not do so, you can download the bash script, see what it doe…
Since it's HTTPS, a signature or checksum are pretty pointless, TLS will do the certificate checking and encryption for you. Serving the file over HTTPS is good because it means no one can do a man in the middle attack to change it, but it's not enough to be secure. If someone compromises the server itself the file could be altered at the source. The point of the checksum is to ensure that the file you're downloading…
> If you host the file in one place and the website in a different place it's harder for an attacker to change both the file and the website that reports the checksum, ...
That is not a practical solution at all. What do users find if they enter the "download" page? A link to an external site containing the checksum? Wouldn't an attacker just replace (or remove!) the link?
The reality of today's identity management is TLS and certificates. If your website is https://oya.sh, then obviously any attacker who has access to the web server can direct clients to their malware downloads. No extra servers will help against that.
Re: Show HN: Oya – New projects set up lightning fast
#68That fading animation on the homepage is super terrible.
Agreed, I fail to understand the popularity of this aesthetic, but it is rather common on 'landing pages' for potentially interesting coding projects. It usually just makes the bottom half of my screen unused real estate.
Re: Show HN: Oya – New projects set up lightning fast
#69Re: Show HN: Oya – New projects set up lightning fast
#70I don’t like to go meta, but this is the meanest response to a Show HN I’ve seen in a while. Almost every comment is a reason why it sucks or a random nitpick.
If you don’t have anything nice to say, just don’t say anything at all.