Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please – A Cross-Language Build System

please.build

Post reply on HN
Print view View original

61–70 of 122 posts

Re: Please – A Cross-Language Build System

#61

Post by abiox »

staticassertion wrote: post #32
ball_of_lint wrote: post #28

I dislike that the only way they list to install is "curl https://get.please.build | bash". I know it's fast and easy but it really leaves your computer at their mercy.

How? It's over HTTPS, and you're already trusting them to execute code on your system... and it's not even root... I see no way in which this "leaves your computer at their mercy" more than any other process of purposefully executing code they control on your system.

this seems like a 'perfect is the enemy of good' framing.

in any event, it's more surface area. their web server being compromised and serving a bad shell script is just more that can go wrong.

Re: Please – A Cross-Language Build System

#63

Post by merlinsbrain »

ktta wrote: post #58
merlinsbrain wrote: post #36

Earlier quoted context omitted.

I agree with the point you’re making and you clearly know what you’re talking about but: I would caution you to use the phrase “no way in which” when discussing security - the less informed may read this and believe it. While an edge case and requiring a mailicious targeted attack in this case there’s at least the possibility of being MiTM’d. The problem - as you’re probably aware - with using absolute terms when spe…

>the less informed may read this and believe it. What they should be doing is to understand what's actually going on. Once you download and run software from a TLS enabled website, you're putting trust in that website. It doesn't really matter if you are doing 'curl https://example.com | bash' or downloading a binary. They can't be MITMed any more so with the curl way than downloading a binary. That's all there is to…

Completely agree that they should understand what’s going on however:

It’s sometimes easy to forget that there are various reasons people are less informed. For people early in the career for example, reading security advice on HN and believing it is not unheard of especially when you have real experts on here who know what they’re talking about.

Something that is “all there is to it” for you is not necessarily the same for someone else. I’m not saying it’s anyones job to inform them; just that it’s better not to speak in absolutes.

If security folks say something, I assume there’s a good reason until I become a security folk myself - it’s one of those fields where being sceptical about everything third-party helps.

My point really wasn’t about the MITM but a there’s always a possibility that a proxy on a public/compromised network can intervene between you and a “secured” website.

Binaries can be verified with checksums to make sure that the artifact hosted on the repository is indeed what you received. You are 100% correct that you are still trusting the code from the third party developer though!

Re: Please – A Cross-Language Build System

#64

Post by ktta »

merlinsbrain wrote: post #63
ktta wrote: post #58

Earlier quoted context omitted.

>the less informed may read this and believe it. What they should be doing is to understand what's actually going on. Once you download and run software from a TLS enabled website, you're putting trust in that website. It doesn't really matter if you are doing 'curl https://example.com | bash' or downloading a binary. They can't be MITMed any more so with the curl way than downloading a binary. That's all there is to…

Completely agree that they should understand what’s going on however: It’s sometimes easy to forget that there are various reasons people are less informed. For people early in the career for example, reading security advice on HN and believing it is not unheard of especially when you have real experts on here who know what they’re talking about. Something that is “all there is to it” for you is not necessarily the s…

>My point really wasn’t about the MITM but a there’s always a possibility that a proxy on a public/compromised network can intervene between you and a “secured” website.

Same can happen to a binary.

>Binaries can be verified with checksums to make sure that the artifact hosted on the repository is indeed what you received

Here's the problem. The checksum is usually on the same page the binary is located. Which pretty much defeats the purpose.

Re: Please – A Cross-Language Build System

#65

Post by merlinsbrain »

ktta wrote: post #64
merlinsbrain wrote: post #63

Earlier quoted context omitted.

Completely agree that they should understand what’s going on however: It’s sometimes easy to forget that there are various reasons people are less informed. For people early in the career for example, reading security advice on HN and believing it is not unheard of especially when you have real experts on here who know what they’re talking about. Something that is “all there is to it” for you is not necessarily the s…

>My point really wasn’t about the MITM but a there’s always a possibility that a proxy on a public/compromised network can intervene between you and a “secured” website. Same can happen to a binary. >Binaries can be verified with checksums to make sure that the artifact hosted on the repository is indeed what you received Here's the problem. The checksum is usually on the same page the binary is located. Which pretty…

I see, and this was your original point.

I guess the only threat there (that I can see) is that the install script can be malicious, but your point was that you’re trusting the owners of the website anyway by downloading their binary and executing their code locally. It can be argued that it’s probably easier to ship malicious code outside the main repository (e.g. in an install script) but I do not have a good counter besides this weak argument.

The checksum is indeed usually on the same page and does make it useless in my hypothetical MITM.

Re: Please – A Cross-Language Build System

#66

Post by qznc »

arunc wrote: post #14
qznc wrote: post #13

Earlier quoted context omitted.

Noted. https://github.com/qznc/annoying-build-systems#please

No love for D's DUB on your list?

I left out package managers from all languages and focused on generic build systems. The line is blurry though. Feel free to send a pull request.

Re: Please – A Cross-Language Build System

#67

Post by ComputerGuru »

imron wrote: post #42
millstone wrote: post #33

Apologies in advance for shitting on this, but PLEASE STOP BUILDING BUILD SYSTEMS. We already have a serious incompatibility problem with projects using autotools vs CMake vs Meson vs gyp vs Boost.Build vs SCons vs BUCK vs... and now we throw Please onto the pile. It sucks when you find a smallish library and discover it uses an esoteric build system whose dependencies dwarf the library themselves (cough Yoga). The O…

> Relevant: http://www.rojtberg.net/1481/do-not-use-meson/ Meson is fantastic.

Except it’s a build system for C/C++ that brings in a dependency on the entire Python kitchen sink just to build a 10kb otherwise dependency-free binary.

Re: Please – A Cross-Language Build System

#68

Post by bb88 »

ComputerGuru wrote: post #67
imron wrote: post #42

Earlier quoted context omitted.

> Relevant: http://www.rojtberg.net/1481/do-not-use-meson/ Meson is fantastic.

Except it’s a build system for C/C++ that brings in a dependency on the entire Python kitchen sink just to build a 10kb otherwise dependency-free binary.

Well, and frankly, python people shouldn't use this anyway.

Re: Please – A Cross-Language Build System

#69

Post by ComputerGuru »

Since this thread has long since devolved into a discussion about build systems in general: if you don’t need a build system with Windows support, go with tup which is otherwise awesome. If you don’t care about bloat in your dev tools, go with meson (modern scons replacement). If you need cross platform and don’t like requirements on needless runtimes, I’m still searching for a good replacement for cmake (BSD Makefiles accomplish much of the same with a saner syntax just not as portably unless you need the ninja/msvc/qt/xcode intermediate build files).

Premake was promising but I fear it fell victim to early hype syndrome.

Re: Please – A Cross-Language Build System

#70

Post by aidenn0 »

ComputerGuru wrote: post #69

Since this thread has long since devolved into a discussion about build systems in general: if you don’t need a build system with Windows support, go with tup which is otherwise awesome. If you don’t care about bloat in your dev tools, go with meson (modern scons replacement). If you need cross platform and don’t like requirements on needless runtimes, I’m still searching for a good replacement for cmake (BSD Makefil…

What's wrong with tup on windows? (I've never used it on windows, but its docs say that windows is supported).
Post reply on HN