Zellij: A terminal workspace with batteries included
1–10 of 105 posts
Re: Zellij: A terminal workspace with batteries included
#2But is it for humans?
Re: Zellij: A terminal workspace with batteries included
#3Please do not pipe scripts downloaded through curl into bash. Use a package manager. That way the downloaded binary can be verified against a checksum and/or GPG signing.
Re: Zellij: A terminal workspace with batteries included
#4I've been using Zellij on both Linux & Mac for around six months.
It's great! For someone who wants a terminal multiplexer but a) doesn't feel like learning all the idiosyncracies of tmux and b) is OK with adding some configs in toml — it's ideal.
The downsides are that it's not perfectly stable — maybe once a month I get a panic — and some terminal cobwebs aren't encapsulated — e.g. it's not possible to use "[" in key mappings.
Re: Zellij: A terminal workspace with batteries included
#5Please do not pipe scripts downloaded through curl into bash. Use a package manager. That way the downloaded binary can be verified against a checksum and/or GPG signing.
Please don't contribute worthless and irrelevant comments like this. As you doubtless well know, piping from curl into bash is something that a large subset of respected programmers think is reasonable, and another rather tedious subset do not. For example, the entire Rust community clearly has a consensus that it's reasonable: https://rustup.rs/ As does homebrew https://brew.sh/ and pyenv https://github.com/pyenv/pyenv-installer#install to name whatever came to my mind in 30s thought.
Since the debate has such large numbers on both sides, your individual opinion on it is neither interesting nor germane.
Re: Zellij: A terminal workspace with batteries included
#6Please do not pipe scripts downloaded through curl into bash. Use a package manager. That way the downloaded binary can be verified against a checksum and/or GPG signing.
Please don't contribute worthless and irrelevant comments like this. As you doubtless well know, piping from curl into bash is something that a large subset of respected programmers think is reasonable, and another rather tedious subset do not. For example, the entire Rust community clearly has a consensus that it's reasonable: https://rustup.rs/ As does homebrew https://brew.sh/ and pyenv https://github.com/pyenv/py…
"a bunch of folks do something insecure" does not speak argument.
The argument is that it is insecure. Most easily because I can inject, "cat ~/.ssh/*_rsa | curl ..." and get your company ssh keys. There's no reason rust, brew and all the rest can't provide a Download page with a checksum. They choose not to, like this project chose not to, because it doesn't look as sexy.
It's really silly.
Re: Zellij: A terminal workspace with batteries included
#7Earlier quoted context omitted.
Please don't contribute worthless and irrelevant comments like this. As you doubtless well know, piping from curl into bash is something that a large subset of respected programmers think is reasonable, and another rather tedious subset do not. For example, the entire Rust community clearly has a consensus that it's reasonable: https://rustup.rs/ As does homebrew https://brew.sh/ and pyenv https://github.com/pyenv/py…
"a bunch of folks do something insecure" does not speak argument. The argument is that it is insecure. Most easily because I can inject, "cat ~/.ssh/*_rsa | curl ..." and get your company ssh keys. There's no reason rust, brew and all the rest can't provide a Download page with a checksum. They choose not to, like this project chose not to, because it doesn't look as sexy. It's really silly.
Why can’t the downloaded binary package do the exact same thing? Or do you decompile and go through those as well?
Re: Zellij: A terminal workspace with batteries included
#8Please do not pipe scripts downloaded through curl into bash. Use a package manager. That way the downloaded binary can be verified against a checksum and/or GPG signing.
Please don't contribute worthless and irrelevant comments like this. As you doubtless well know, piping from curl into bash is something that a large subset of respected programmers think is reasonable, and another rather tedious subset do not. For example, the entire Rust community clearly has a consensus that it's reasonable: https://rustup.rs/ As does homebrew https://brew.sh/ and pyenv https://github.com/pyenv/py…
Have you read the Hacker News Guidelines, particularly the section labeled "In Comments"? If you haven't, I suggest that you should.
Re: Zellij: A terminal workspace with batteries included
#9Please do not pipe scripts downloaded through curl into bash. Use a package manager. That way the downloaded binary can be verified against a checksum and/or GPG signing.
Please don't contribute worthless and irrelevant comments like this. As you doubtless well know, piping from curl into bash is something that a large subset of respected programmers think is reasonable, and another rather tedious subset do not. For example, the entire Rust community clearly has a consensus that it's reasonable: https://rustup.rs/ As does homebrew https://brew.sh/ and pyenv https://github.com/pyenv/py…
I for one think that this individual opinion has value under this post as a PSA to people who might not otherwise give the command a second thought, regardless of the conclusion they take away.
Re: Zellij: A terminal workspace with batteries included
#10Earlier quoted context omitted.
"a bunch of folks do something insecure" does not speak argument. The argument is that it is insecure. Most easily because I can inject, "cat ~/.ssh/*_rsa | curl ..." and get your company ssh keys. There's no reason rust, brew and all the rest can't provide a Download page with a checksum. They choose not to, like this project chose not to, because it doesn't look as sexy. It's really silly.
Why can’t the downloaded binary package do the exact same thing? Or do you decompile and go through those as well?
It could, but I can trust that no individual stepped in the middle of that process.
I trust Rust to not put such a thing in their binary. I do not trust an arbitrary man in the middle, and it's trivial to modify a shell script.
Without a checksum, I can't ensure the binary im piping through the shell is the binary they posted and built. Anyone can step in, modify a few lines, and get access to a large part of my system. The barrier to entry to add such capability to arbitrary binaries is outrageously high.