Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please – A Cross-Language Build System

please.build

Post reply on HN
Print view View original

51–60 of 122 posts

Re: Please – A Cross-Language Build System

#51

Post by kodablah »

millstone wrote: post #33

Apologies in advance for shitting on this, but PLEASE STOP BUILDING BUILD SYSTEMS. We already have a serious incompatibility problem with projects using autotools vs CMake vs Meson vs gyp vs Boost.Build vs SCons vs BUCK vs... and now we throw Please onto the pile. It sucks when you find a smallish library and discover it uses an esoteric build system whose dependencies dwarf the library themselves (cough Yoga). The O…

Some might think, myself included, that some of the problems you are stating is caused by build system dogma, e.g. "stop building build systems, other projects aren't moving, so it makes you esoteric". Current build systems suck. It also sucks that there are so many. It's unfair that everyone has to hear that they contribute to the latter just because they want to solve the former.

What sucks more to me than finding a lib using its own build system is finding a lib that won't adopt more modern ones or languages that refuse to fix their defacto language-specific build systems, both caused by the sentiments you state about having too many and/or it being too hard for builders to change their ways. There is a middle ground here and it starts with asking software to move forward, not asking it to stop.

Re: Please – A Cross-Language Build System

#52

Post by shakna »

merlinsbrain wrote: post #36
staticassertion wrote: post #32

Earlier quoted context omitted.

How? It's over HTTPS, and you're already trusting them to execute code on your system... and it's not even root... I see no way in which this "leaves your computer at their mercy" more than any other process of purposefully executing code they control on your system.

I agree with the point you’re making and you clearly know what you’re talking about but: I would caution you to use the phrase “no way in which” when discussing security - the less informed may read this and believe it. While an edge case and requiring a mailicious targeted attack in this case there’s at least the possibility of being MiTM’d. The problem - as you’re probably aware - with using absolute terms when spe…

A glance inside their shell script shows they don't protect against something as simple as a broken connection. Because curl | bash is vulnerable to partial execution.

For the inner downloads in the script, they use the -fsSL flags, which would protect against such broken behaviour. But not their use-facing script.

More to the point, the install just downloads:

https://get.please.build/${GOOS}_amd64/${VERSION}/please_${V...

then unzips and links it to PATH. No checking the source isn't corrupt, no checking if the tar archive successfully expands. (And the var GOOS seems to depend on an environment variable I don't think is guaranteed to exist. It certainly doesn't on my Mac.)

If that's the case... Why not just provide a download link? It won't have the same issue as a broken install if the connection drops, and is just as easy. The only technical bit, linking to PATH, is something the end audience could be expected to know.

Re: Please – A Cross-Language Build System

#55

Post by wocram »

numbsafari wrote: post #23
iainmerrick wrote: post #16

Earlier quoted context omitted.

What's hard about "brew install bazel"?

Why should I have to install the jdk for a build tool when I’m not using Java myself?

Are you opposed to java, or to installing being more than one step?

Re: Please – A Cross-Language Build System

#57

Post by jimktrains2 »

numbsafari wrote: post #23
iainmerrick wrote: post #16

Earlier quoted context omitted.

What's hard about "brew install bazel"?

Why should I have to install the jdk for a build tool when I’m not using Java myself?

Why should I have to install dependencies when I don't directly use them!

Re: Please – A Cross-Language Build System

#58

Post by ktta »

merlinsbrain wrote: post #36
staticassertion wrote: post #32

Earlier quoted context omitted.

How? It's over HTTPS, and you're already trusting them to execute code on your system... and it's not even root... I see no way in which this "leaves your computer at their mercy" more than any other process of purposefully executing code they control on your system.

I agree with the point you’re making and you clearly know what you’re talking about but: I would caution you to use the phrase “no way in which” when discussing security - the less informed may read this and believe it. While an edge case and requiring a mailicious targeted attack in this case there’s at least the possibility of being MiTM’d. The problem - as you’re probably aware - with using absolute terms when spe…

>the less informed may read this and believe it.

What they should be doing is to understand what's actually going on.

Once you download and run software from a TLS enabled website, you're putting trust in that website. It doesn't really matter if you are doing 'curl https://example.com | bash' or downloading a binary. They can't be MITMed any more so with the curl way than downloading a binary.

That's all there is to it. I realize there are many security people who advice against doing the curl thing, but I feel people should realize it is a rule of thumb with unsecured websites.

Re: Please – A Cross-Language Build System

#59

Post by abiox »

iriei283 wrote: post #40
millstone wrote: post #33

Apologies in advance for shitting on this, but PLEASE STOP BUILDING BUILD SYSTEMS. We already have a serious incompatibility problem with projects using autotools vs CMake vs Meson vs gyp vs Boost.Build vs SCons vs BUCK vs... and now we throw Please onto the pile. It sucks when you find a smallish library and discover it uses an esoteric build system whose dependencies dwarf the library themselves (cough Yoga). The O…

PRs welcome This is awful demanding. Not entirely unexpected in tech tho “Why don’t others fix my frustration in open source projects!” they shout with no hint of irony

i'm unclear on your message. are you saying "PRs welcome" is demanding? are you saying the creators of 'please' should have contributed to bazel/buck/pants/x/y/z?

Re: Please – A Cross-Language Build System

#60

Post by abiox »

numbsafari wrote: post #23
iainmerrick wrote: post #16

Earlier quoted context omitted.

What's hard about "brew install bazel"?

Why should I have to install the jdk for a build tool when I’m not using Java myself?

i don't notice people complaining about needing ruby, python, perl or other things installed for a given tool that depends on them nearly as much as java. interesting.
Post reply on HN