Live data from Hacker News

Curl to shell isn't so bad

arp242.net

131–140 of 201 posts

Re: Curl to shell isn't so bad

#131
post #81

Earlier quoted context omitted.

Right. I love Debian, but its packages are often very stale. That's why many end up using Ubuntu. And yes, I get that package review takes time, and that Debian is arguably more secure. But that's little consolation when you're dead in the water because what's packaged is too old.

If Ubuntu is the not stale alternative to Debian (stable), then I can't imagine how bad the situation is there. I often build software myself because Ubuntu is very often stale.

Ubuntu LTS (freezes every two years) or "regular" Ubuntu (freezes every six months)?

I'm wondering if the periodic freeze-the-universe model that many distros use reflects a world that doesn't really exist anymore where distros came on DVDs (or CDs, or floppies). Whatever version you had on the disc, that's the version you're going to use.

I just started playing with FreeBSD in a VM, which has a frozen base system and constantly-updated packages separate from it. This works better for software you don't think of as an "OS component" but the question then becomes where you draw the line.

Or maybe it's just a fundamental disconnect between consumer-facing "move fast and break things" and enterprise-level "never break anything even if it means you can't move at all" and there's no way to make software that works for both.

Re: Curl to shell isn't so bad

#135
post #36

Earlier quoted context omitted.

> Every decent Linux distro has a package manager that covers 99% of the software you want to install I wish this were true, but plenty of experience with Linux usage tells me that not having something packaged is a very common occurence. Though of course this can be improved: More people should actually help working on their favorite Linux distro, so more software gets packaged. And upstreams should try better to co…

Making Debian packages is a colossal pain in the ass, or at least it's poorly documented. I've tried to learn it twice and abandoned it for more user-friendly solutions to the problem. Some people may say I'm stupid for not figuring it out, but the standard for usability of software has improved a lot since these systems were invented. The UX needs a serious overall.

I guess you are exagerating quite a bit.

Creating a Debian package is actually pretty straight forward:

1. download upstream tarball.

2. execute dh_make -f

3. debuild -us -uc -b

That is it! There is no secret.

dh_make does the heavy lift of generating everything you need.

Your only job is to declare the dependencies (build and runtime ones) inside the "control" file, maybe change the "rules" file (it is a Makefile).

There are also several helpers that goes even further and automate 99% of the process.

Re: Curl to shell isn't so bad

#136
post #82
post #70

Earlier quoted context omitted.

There are user space package managers, e.g. conda, flatpack and homebrew come to mind.

Ironically conda and Homebrew themselves need to be installed from a script off the internet

Conda has an .exe installer on Windows and a .pkg installer on macOS. Both signed by Anaconda, Inc. for the OS. There are RPM and deb bootstrap repos for Linux. Then there’s also the .sh shar file installer.

Re: Curl to shell isn't so bad

#137

Earlier quoted context omitted.

The curl|bash might actually clone a repo and build it. Your concern is a different one.

Yes, it could. But it that was the case, the site would say one can just clone the repo and build it instead of sending everybody into the curl route.

Some of them do say that.

Re: Curl to shell isn't so bad

#138
post #35

Not so bad comparing to what? Yeah, comparing to downloading a tar file from the website and running ./configure, make etc - right, it's probably quite a similar risk. But who does that? Every decent Linux distro has a package manager that covers 99% of the software you want to install, and comparing to an apt-get install, pacman -S, yum install and so on - running is a script off some website is way more risky. My p…

Well if this was true "Every decent Linux distro has a package manager that covers 99% of the software you want to install" we wouldn't have to install it thru sh.

Indeed. It must be the other 99% that aren’t in the repos because I have to install a lot of things that aren’t available in repos (or that haven’t been updated in stable in a long time).

Re: Curl to shell isn't so bad

#139

For the most part this is a problem with non-rolling-release distros. There are very few instances in which I've had to even use an installer on Arch. For many of those cases, the AUR provides a package that verifies the hash of the downloaded file anyway. I've constantly been frustrated when using Ubuntu because something basic like having 'vim' not be months out of date requires a PPA. The 'official' Rust installat…

Rolling-release and fixed-version distros serve different purposes. A fixed-version OS has a set of software packages at specific versions which have been tested together, both by test suites and by the many users using the same version set. Security patches and bugfixes get patched in, but the packaged software doesn't undergo major changes. That's important if you're running a critical production system. Rolling-re…

I agree.

But no-one should be running this curl | sh nonsense in prod anyway, right. You at least want a defined version so you'd save the artifact instead of piping.

To me, the whole thing seems like a solution to a self imposed problem. It reminds me of the old "frankendebian" stuff in which people would be warned against having a system half-stable half-unstable.

Post reply on HN