11–20 of 105 posts
Please do not pipe scripts downloaded through curl into bash. Use a package manager. That way the downloaded binary can be verified against a checksum and/or GPG signing.
Earlier quoted context omitted.
Why can’t the downloaded binary package do the exact same thing? Or do you decompile and go through those as well?
It could, but I can trust that no individual stepped in the middle of that process. I trust Rust to not put such a thing in their binary. I do not trust an arbitrary man in the middle, and it's trivial to modify a shell script. Without a checksum, I can't ensure the binary im piping through the shell is the binary they posted and built. Anyone can step in, modify a few lines, and get access to a large part of my syst…
Not everyone uses Linux, and not every package can be audited by repo devs. It’s simply not scalable.
Earlier quoted context omitted.
Please don't contribute worthless and irrelevant comments like this. As you doubtless well know, piping from curl into bash is something that a large subset of respected programmers think is reasonable, and another rather tedious subset do not. For example, the entire Rust community clearly has a consensus that it's reasonable: https://rustup.rs/ As does homebrew https://brew.sh/ and pyenv https://github.com/pyenv/py…
"a bunch of folks do something insecure" does not speak argument. The argument is that it is insecure. Most easily because I can inject, "cat ~/.ssh/*_rsa | curl ..." and get your company ssh keys. There's no reason rust, brew and all the rest can't provide a Download page with a checksum. They choose not to, like this project chose not to, because it doesn't look as sexy. It's really silly.
Going even further, what is stopping a malicious attack on the package source itself--like someone gaining control of the package source and committing a malicious version (as NPM, pypi and other registries have seen)?
The point is, "use your package manager" is not any better in the grand scheme of things than blindly curling and executing a script. Neither option is perfectly secure.
Earlier quoted context omitted.
Please don't contribute worthless and irrelevant comments like this. As you doubtless well know, piping from curl into bash is something that a large subset of respected programmers think is reasonable, and another rather tedious subset do not. For example, the entire Rust community clearly has a consensus that it's reasonable: https://rustup.rs/ As does homebrew https://brew.sh/ and pyenv https://github.com/pyenv/py…
Have you read the Hacker News Guidelines, particularly the section labeled "In Comments"? If you haven't, I suggest that you should.
> Please don't complain about tangential annoyances—things like article or website formats, name collisions, or back-button breakage. They're too common to be interesting.
> Avoid unrelated controversies, generic tangents, and internet tropes.
> Please don't post shallow dismissals, especially of other people's work.
> Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead.
Earlier quoted context omitted.
Please don't contribute worthless and irrelevant comments like this. As you doubtless well know, piping from curl into bash is something that a large subset of respected programmers think is reasonable, and another rather tedious subset do not. For example, the entire Rust community clearly has a consensus that it's reasonable: https://rustup.rs/ As does homebrew https://brew.sh/ and pyenv https://github.com/pyenv/py…
"a bunch of folks do something insecure" does not speak argument. The argument is that it is insecure. Most easily because I can inject, "cat ~/.ssh/*_rsa | curl ..." and get your company ssh keys. There's no reason rust, brew and all the rest can't provide a Download page with a checksum. They choose not to, like this project chose not to, because it doesn't look as sexy. It's really silly.
If you can inject that breaking TLS which secures everything on the internet, why can't you inject your own checksum on the "download page"?
Please do not pipe scripts downloaded through curl into bash. Use a package manager. That way the downloaded binary can be verified against a checksum and/or GPG signing.
The developer has accounted for this with a prominent link to the file in question, see “View the script that will be executed here”.
But is it for humans?
Earlier quoted context omitted.
Please don't contribute worthless and irrelevant comments like this. As you doubtless well know, piping from curl into bash is something that a large subset of respected programmers think is reasonable, and another rather tedious subset do not. For example, the entire Rust community clearly has a consensus that it's reasonable: https://rustup.rs/ As does homebrew https://brew.sh/ and pyenv https://github.com/pyenv/py…
"a bunch of folks do something insecure" does not speak argument. The argument is that it is insecure. Most easily because I can inject, "cat ~/.ssh/*_rsa | curl ..." and get your company ssh keys. There's no reason rust, brew and all the rest can't provide a Download page with a checksum. They choose not to, like this project chose not to, because it doesn't look as sexy. It's really silly.
But really, curl | bash isn't the end of the world.
If they do it against a github url they also have the security of github behind you, because you can't differentiate on user agent there, which seems to be the commonly argued pitfall. Or other ways to detect you're not a browser, on a hosted platform you have someone else's security team behind your back.
But is it for humans?
The interface is very discoverable, unlike screen or tmux. You can start using it productively even before reading any documentation. The keybindings feel like a cross between vim (modal) bindings and CUA bindings.