Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SpaceVim – Like Spacemacs, but for Vim

spacevim.org

Post reply on HN
Print view View original

51–60 of 186 posts

Re: SpaceVim – Like Spacemacs, but for Vim

#51

Post by kelnos »

xkxx wrote: post #28
scrollaway wrote: post #20

Earlier quoted context omitted.

curl sh is no more dangerous than running any script you haven't read, or binary you haven't decompiled for that matter. The odds of mitm are exactly the same.

There are 2 types of "any script you haven't read, or binary you haven't decompiled": 1. scripts and binaries you obtained from somebody you trust in a safe authenticated way; 2. everything else. When I update my Debian distro, I get binaries via HTTP, that's true. But I also have the public keys of my distro's maintainers whom I trust. The authenticity of every binary I download is automatically checked using those…

Do you never install any software outside Debian's main apt repos? Never add a 3rd-party apt repo for anything that maybe you didn't trust as much? Never clone a git/hg/svn/etc. repo from somewhere and build & install the software yourself?

Ok, let's say you don't do any of that. The Debian developers are still fallible, and they certainly don't audit the source code of everything they package. Sure, you have to trust something, and I'll certainly agree that it's more reasonable to trust the Debian packagers (and their distribution infrastructure) than a lot of other things, but saying "curl | sh" (when you're curl'ing over https at least, from a website you can reasonably expect not to be compromised) is always bad is a bit extremist. At any rate, the shell script you download is there for you to inspect before running, and if you're not happy with it, you don't have to run it.

Personally, my main beef with that sort of thing is that I want to know if the script is going to accidentally clobber any existing files, or install things to a location where I might not prefer them to be installed.

Edit: I'm only now realizing that the OP has you curl from a non-TLS webserver, which I imagine is the first thing that got you upset. Ugh. Asking people to install something that way is just irresponsible.

Re: SpaceVim – Like Spacemacs, but for Vim

#52

Post by awalGarg »

bjackman wrote: post #47
xkxx wrote: post #16

Oh, yeah! Good old curl | sh via HTTP. Fucking awesome. I wonder how many people get unknowingly pwned while executing such curl | sh instructions. It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Or you can just compile a list of known sources that encourage to execute curl | sh and MitM only them if you want to make your exploits even more discreet.…

For me the insecurity isn't even the worst thing about curl | sh. I like package managers, and I tolerate tarballs, because I know what they do and how to reverse it. I care about the organisation of my filesystem and suspect that the people who suggest I pipe their script into my shell do not care at all.

I have similar concerns. Also, these scripts pretty much never have an accompanying "uninstall" or "reset system state" scripts.

For parent: check out http://github.com/awalGarg/curl-tap-sh (disclaimer: I am the author, and it was on HN's frontpage already a while ago)

Re: SpaceVim – Like Spacemacs, but for Vim

#53

Post by dkersten »

xkxx wrote: post #16

Oh, yeah! Good old curl | sh via HTTP. Fucking awesome. I wonder how many people get unknowingly pwned while executing such curl | sh instructions. It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Or you can just compile a list of known sources that encourage to execute curl | sh and MitM only them if you want to make your exploits even more discreet.…

You need access to infrastructure of ISP.

You don't even need that. You could spoof a wifi network with a PineAP or similar and MitM at that level.

Re: SpaceVim – Like Spacemacs, but for Vim

#55

Post by scrollaway »

chrismorgan wrote: post #2

… and people wonder why I dislike Markdown. (There are fairly radical rendering differences between the GitHub page and the spacevim.org page, because different Markdown renderers with different bugs have been used, and the Markdown was fairly sloppily written.)

It looks like whatever Github pages is using as renderer (kramdown iirc?) does not support postfix links like [dein.vim] here: https://raw.githubusercontent.com/SpaceVim/SpaceVim/dev/READ...

The table rendering issues I suspect are from the lack of a newline after the headers. I don't know whether it's correct or not because, yknow, markdown.

Still better than rst. :)

Re: SpaceVim – Like Spacemacs, but for Vim

#56

Post by ageofwant »

xkxx wrote: post #16

Oh, yeah! Good old curl | sh via HTTP. Fucking awesome. I wonder how many people get unknowingly pwned while executing such curl | sh instructions. It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Or you can just compile a list of known sources that encourage to execute curl | sh and MitM only them if you want to make your exploits even more discreet.…

I'm guessing almost nobody.

What you have is an acute case of righteous rage against a flaming straw-man. The only medicine against this affliction is girding your loins and guarding your mind against those seemingly plausible but ultimately horseshit security theater tropes, so popular among the impressionable today.

Attacking curl yielding nerds is not going to get you a botnet.

Re: SpaceVim – Like Spacemacs, but for Vim

#57

Post by joefreeman »

madmax108 wrote: post #8

The greatest dev timesaving tip that someone gave me was to clear my .vimrc and start off with a blank slate. vim is a language in itself [1] and it's easy to try to mimic someone who has conversational fluency in it, but as with languages, the only way to learn in practice from the start. Projects like SpaceVim try to create an IDE like environment, but because of being terminal driven, it's difficult for anyone to…

I discovered recently that the default install of vim on Ubuntu (and I guess Debian in general) includes some customised configuration (/usr/share/vim/vim74/debian.vim), which makes it a bit harder to grasp what's going on.

Re: SpaceVim – Like Spacemacs, but for Vim

#59

Post by ageofwant »

madmax108 wrote: post #8

The greatest dev timesaving tip that someone gave me was to clear my .vimrc and start off with a blank slate. vim is a language in itself [1] and it's easy to try to mimic someone who has conversational fluency in it, but as with languages, the only way to learn in practice from the start. Projects like SpaceVim try to create an IDE like environment, but because of being terminal driven, it's difficult for anyone to…

I've seen this sentiment here and there but I've yet to appreciate it... I've observed co-workers that do this and while they do get very handy with their selected subset of tools, they tend to use far less of the available ecosystem than a promiscuous copy paster, or a framework user, like me. I think its got a lot to do about temperament - some people like more control over less, and find the secret squirrel magic below somewhat sinister. There is no way that I would be able to build spacemacs from scratch, but I do benefit a lot from riding the integrated magic beast, even if it sometimes go into holes no amount of cursing and praying can prevent.

Re: SpaceVim – Like Spacemacs, but for Vim

#60

Post by yani »

madmax108 wrote: post #39
adrusi wrote: post #31

Earlier quoted context omitted.

Starting with a blank slate lets you refer to just the program's documentation to configure it, while if you start with a config bundle you'll have to refer to both the program's documentation and the bundle's documentation, and you'll have to be decently familiar with both how the program works and what the bundle does in order to make creative customizations. Using a configuration bundle makes the learning curve le…

>>> Using a configuration bundle makes the learning curve less steep but more tall, essentially. Beautiful quote which I'll definitely use more often :)

If you are going to quote it, remember that it is "taller" and not "more tall"
Post reply on HN