This is really just a Makefile in yaml without lots of the features and the milions of support articles.
Show HN: Oya – New projects set up lightning fast
11–20 of 111 posts
Re: Show HN: Oya – New projects set up lightning fast
#12> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
Since it's HTTPS, a signature or checksum are pretty pointless, TLS will do the certificate checking and encryption for you. Your assertion that "if your server gets hacked, so do your customers", also applies to a checksum, as the hackers would just change the checksum listed on the website. If you have a problem with piping curl to bash, then you can just not do so, you can download the bash script, see what it doe…
I don't understand your first paragraph. Could you elaborate?
Re: Show HN: Oya – New projects set up lightning fast
#13Earlier quoted context omitted.
Since it's HTTPS, a signature or checksum are pretty pointless, TLS will do the certificate checking and encryption for you. Your assertion that "if your server gets hacked, so do your customers", also applies to a checksum, as the hackers would just change the checksum listed on the website. If you have a problem with piping curl to bash, then you can just not do so, you can download the bash script, see what it doe…
I don't understand your first paragraph. Could you elaborate?
curl will error out if the chain of trust is invalid, unless you override it with the -k option.
Re: Show HN: Oya – New projects set up lightning fast
#14> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
I recall two other popular projects doing the curl xyz| bash approach
Rust[0] Chef [1]
And here is an old HN comment[2] going into why it doesn't really matter.
Besides it's a Show HN- why be negative when we can raise the same issue more constructively as "Please add checksums and digital signatures. Also why not use regular GitHub releases in the installation instructions?"
[0] https://doc.rust-lang.org/book/ch01-01-installation.html [1] https://docs.chef.io/install_omnibus.html [2] https://news.ycombinator.com/item?id=12766049
Re: Show HN: Oya – New projects set up lightning fast
#15Yeah nah.
Re: Show HN: Oya – New projects set up lightning fast
#16This is really just a Makefile in yaml without lots of the features and the milions of support articles.
It feels like a header called “why this is better than GNU Make” should be somewhere in there. With the provided example, it looks like Oya does less than POSIX Make (which is significantly less powerful than either BSD or GNU Make).
Re: Show HN: Oya – New projects set up lightning fast
#17How does this add anything to my process compared to npm tasks, that do the automated work right now, together with out Gitlab CI system?
It isn't restricted to JavaScript/Node, for one.
Re: Show HN: Oya – New projects set up lightning fast
#18The product website links on the footer are not functional. I advise to hide them until you have the pages up.
Re: Show HN: Oya – New projects set up lightning fast
#19> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
Since it's HTTPS, a signature or checksum are pretty pointless, TLS will do the certificate checking and encryption for you. Your assertion that "if your server gets hacked, so do your customers", also applies to a checksum, as the hackers would just change the checksum listed on the website. If you have a problem with piping curl to bash, then you can just not do so, you can download the bash script, see what it doe…
Since it's HTTPS, a signature or checksum are pretty pointless, TLS will do the certificate checking and encryption for you.
Serving the file over HTTPS is good because it means no one can do a man in the middle attack to change it, but it's not enough to be secure. If someone compromises the server itself the file could be altered at the source. The point of the checksum is to ensure that the file you're downloading is the file you're expecting. If you host the file in one place and the website in a different place it's harder for an attacker to change both the file and the website that reports the checksum, so you can be much more confident the file is correct. HTTPS on it's own doesn't give you that.
Re: Show HN: Oya – New projects set up lightning fast
#20> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
Security concerns aside, a misconfigured gateway in between (say, they use Cloudflare) can easily result in an “HTML” response being piped to my bash. The f-ing mess it could create in my home directory is unimaginable.