Yeoman: Modern workflows for modern webapps • Hacker News Board

Re: Yeoman: Modern workflows for modern webapps

#11

Post by jvehent » Mon, Sep 10, 2012, 6:13 PM UTC

Stop doing `curl get.whatever.com|bash` ! Seriously. I have nothing against your install script, but getting devs use to that is a terrible idea !

I spent weeks explaining to junior devs to not do that on production servers. I thought it was obvious, but apparently it isn't...

Re: Yeoman: Modern workflows for modern webapps

#12

Post by nthitz » Mon, Sep 10, 2012, 6:29 PM UTC

pdelgallego wrote: post #10

I see that they mention backbone and ember, but how does Yeoman play with angularJs?

Their github page mentions angularJS https://github.com/yeoman/yeoman

Re: Yeoman: Modern workflows for modern webapps

#13

Post by nthitz » Mon, Sep 10, 2012, 6:30 PM UTC

jvehent wrote: post #11

Stop doing `curl get.whatever.com|bash` ! Seriously. I have nothing against your install script, but getting devs use to that is a terrible idea ! I spent weeks explaining to junior devs to not do that on production servers. I thought it was obvious, but apparently it isn't...

Excuse the naivety but what's the issue?

Re: Yeoman: Modern workflows for modern webapps

#14

Post by freyrs3 » Mon, Sep 10, 2012, 6:35 PM UTC

nthitz wrote: post #13

jvehent wrote: post #11

Stop doing `curl get.whatever.com|bash` ! Seriously. I have nothing against your install script, but getting devs use to that is a terrible idea ! I spent weeks explaining to junior devs to not do that on production servers. I thought it was obvious, but apparently it isn't...

Excuse the naivety but what's the issue?

It silently executes arbitrary code from a remote server.

Re: Yeoman: Modern workflows for modern webapps

#15

Post by mvanga » Mon, Sep 10, 2012, 6:37 PM UTC

nthitz wrote: post #13

jvehent wrote: post #11

Stop doing `curl get.whatever.com|bash` ! Seriously. I have nothing against your install script, but getting devs use to that is a terrible idea ! I spent weeks explaining to junior devs to not do that on production servers. I thought it was obvious, but apparently it isn't...

Excuse the naivety but what's the issue?

You are asking developers to download a shell script from $random_site and run it immediately without any thoughts whatsoever as to what effects it might have.

Getting people used to that is a bad idea.

Re: Yeoman: Modern workflows for modern webapps

#16

Post by weaksauce » Mon, Sep 10, 2012, 6:41 PM UTC

nthitz wrote: post #13

jvehent wrote: post #11

Stop doing `curl get.whatever.com|bash` ! Seriously. I have nothing against your install script, but getting devs use to that is a terrible idea ! I spent weeks explaining to junior devs to not do that on production servers. I thought it was obvious, but apparently it isn't...

Excuse the naivety but what's the issue?

You are piping the output of an untrusted command into a shell that will execute it. This leaves no way to verify that the code your are running is legit. No md5 verification, no cursory inspection of the script, etc.... There could even be hijacked dns that points to a server that specifically does a bad thing. Maybe not a huge deal for small projects but it's not a great idea in general.

Try this to see a proof of concept:

$echo "echo test" | bash

Re: Yeoman: Modern workflows for modern webapps

#17

Post by brian_c » Mon, Sep 10, 2012, 6:41 PM UTC

The install script takes staggering liberty with your system to fetch its dependencies. Make sure you read it before running.

http://get.yeoman.io

Re: Yeoman: Modern workflows for modern webapps

#18

Post by tptacek » Mon, Sep 10, 2012, 6:42 PM UTC

nthitz wrote: post #13

jvehent wrote: post #11

Stop doing `curl get.whatever.com|bash` ! Seriously. I have nothing against your install script, but getting devs use to that is a terrible idea ! I spent weeks explaining to junior devs to not do that on production servers. I thought it was obvious, but apparently it isn't...

Excuse the naivety but what's the issue?

You mean besides the fact that this gives remote code execution to anyone who can spoof a DNS record?

Re: Yeoman: Modern workflows for modern webapps

#19

Post by ch0wn » Mon, Sep 10, 2012, 6:44 PM UTC

When I saw the Bower announcement yesterday I was a bit concerned that with Yeoman coming up in the next weeks, there would soon be two brand new competing front-end package managers. It's presently surprised that Yeoman actually builds on top of Bower.

Re: Yeoman: Modern workflows for modern webapps

#20

Post by nthitz » Mon, Sep 10, 2012, 6:50 PM UTC

mvanga wrote: post #15

nthitz wrote: post #13

Earlier quoted context omitted.

Excuse the naivety but what's the issue?

You are asking developers to download a shell script from $random_site and run it immediately without any thoughts whatsoever as to what effects it might have. Getting people used to that is a bad idea.

Is it so different from running a make install or a install.sh script?