I like this and I see the need for it, being a long time Make user and supporter. Will give this a try.
Show HN: Oya – New projects set up lightning fast
21–30 of 111 posts
Re: Show HN: Oya – New projects set up lightning fast
#22Earlier quoted context omitted.
Running random automated scripts from the web is not a good idea
Like 95% of websites with JavaScript? :)
No, because JS runs in the browser sandbox and has no access to the rest of your machine. That's very different to running a bash script from curl.
Re: Show HN: Oya – New projects set up lightning fast
#23Seems like Yeoman? https://yeoman.io/
Re: Show HN: Oya – New projects set up lightning fast
#24> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
+1
A docker image would be much better than a random script.
Re: Show HN: Oya – New projects set up lightning fast
#25I went through most of the documentation but I still don't understand how this will help me in any way. I don't understand what it is?
> Become a hero
Marketing jargon like this is IMO very tiring. I am a hero because I use your product? Ok, I guess that is a very loose definition of that word.
I don't want to be negative really, but I have actually no clue what this product does or what problem it solves.
Re: Show HN: Oya – New projects set up lightning fast
#26This is a horrible marketing piece...I'm assuming it bootstraps a go project because one of the files was go, but nowhere does it say what language/framework you're bootstrapping...at first I assumed it was just another express.js bootstrapper...
Re: Show HN: Oya – New projects set up lightning fast
#27> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
I really recommend pipethis [1] for these scenarios. It's based on public-key cryptography, so an attacker who gains control of the server can't just update the hash (hosted on the same server).
Re: Show HN: Oya – New projects set up lightning fast
#28Earlier quoted context omitted.
I don't understand your first paragraph. Could you elaborate?
curl will error out if the chain of trust is invalid, unless you override it with the -k option.
Guess what, all you need to prove in order to get a new "valid" cert is that you control the server. And, if you control the server then you already have access to the original certificates, so you probably don't even need new certs.
Re: Show HN: Oya – New projects set up lightning fast
#29Earlier quoted context omitted.
Running random automated scripts from the web is not a good idea
It's not meaningfully different than downloading software with an installer/install script and running it on your machine. Though obviously, you could just curl it, read it, and then bash it.
[deleted]
Re: Show HN: Oya – New projects set up lightning fast
#30This seems like a good idea but I get the feeling its been done (npm, pip, makefiles, gist, etc..) or tried to be done a lot of times and I'm not sure what makes this different. But maybe I'm just a laymen and don't understand the finer points so if there's a compelling argument my feedback is to include something about it on the homepage or in a FAQ.