Show HN: Oya – New projects set up lightning fast
1–10 of 111 posts
Re: Show HN: Oya – New projects set up lightning fast
#2> curl https://oya.sh/get | bash
You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers.
Why don't you use your github releases in the installation instructions?
Re: Show HN: Oya – New projects set up lightning fast
#3> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
It's already on GitHub, the shell script is just a wrapper to handle automating the download and install of the latest release.
Re: Show HN: Oya – New projects set up lightning fast
#4> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
If their GitHub account gets hacked, so do their customers. What's the fundamental difference?
Re: Show HN: Oya – New projects set up lightning fast
#5How does this add anything to my process compared to npm tasks, that do the automated work right now, together with out Gitlab CI system?
Re: Show HN: Oya – New projects set up lightning fast
#6> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
Since it's HTTPS, a signature or checksum are pretty pointless, TLS will do the certificate checking and encryption for you.
Your assertion that "if your server gets hacked, so do your customers", also applies to a checksum, as the hackers would just change the checksum listed on the website.
If you have a problem with piping curl to bash, then you can just not do so, you can download the bash script, see what it does, and modify it before running it. It's only 140 lines and it's fairly simple.
Further to your point, the bash script also does checksums internally!
Putting releases up on github isn't a bad idea, but their github account credentials could also be hacked, so it's no more secure than this really.
Re: Show HN: Oya – New projects set up lightning fast
#7> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
It's already on GitHub, the shell script is just a wrapper to handle automating the download and install of the latest release.
Running random automated scripts from the web is not a good idea
Re: Show HN: Oya – New projects set up lightning fast
#8> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
A blog on this general attitude: https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p...
The difference between a digital signature and HTTPS for identity verification is probably somewhat of a toss-up, and a checksum hosted on the same server as the download is mostly useless for anything but ensuring your download of the malicious version completed successfully.
Re: Show HN: Oya – New projects set up lightning fast
#9Re: Show HN: Oya – New projects set up lightning fast
#10Earlier quoted context omitted.
It's already on GitHub, the shell script is just a wrapper to handle automating the download and install of the latest release.
Running random automated scripts from the web is not a good idea
It's not meaningfully different than downloading software with an installer/install script and running it on your machine. Though obviously, you could just curl it, read it, and then bash it.