Yeoman: Modern workflows for modern webapps • Hacker News Board

Re: Yeoman: Modern workflows for modern webapps

#21

Post by varikin » Mon, Sep 10, 2012, 7:03 PM UTC

nthitz wrote: post #20

mvanga wrote: post #15

Earlier quoted context omitted.

You are asking developers to download a shell script from $random_site and run it immediately without any thoughts whatsoever as to what effects it might have. Getting people used to that is a bad idea.

Is it so different from running a make install or a install.sh script?

The biggest problem is validating the download prior to installing it. The use make install or install.sh or other similar script, the following should be done:

Download package

md5 package

verify md5 == published md5 of packge

extract

make install / install.sh / etc

With "curl package.github.com" | bash" the validation is missing. I don't mind the curl x | bash for my dev machine or testing/dev vms, but that is not happening on production. And if I need said software on production, I have to find a different way to install.

Re: Yeoman: Modern workflows for modern webapps

#22

Post by desireco42 » Mon, Sep 10, 2012, 7:20 PM UTC

This is great. I would like to support it spinejs, maybe it is easy to add, haven't look yet.

This reminds me how much we need a global package manager, for most of the open source languages. Why would each framework need it's own way of handling dependencies.

Re: Yeoman: Modern workflows for modern webapps

#23

Post by [deleted] » Mon, Sep 10, 2012, 7:25 PM UTC

[deleted]

Re: Yeoman: Modern workflows for modern webapps

#24

Post by ominous_prime » Mon, Sep 10, 2012, 7:26 PM UTC

jvehent wrote: post #11

Stop doing `curl get.whatever.com|bash` ! Seriously. I have nothing against your install script, but getting devs use to that is a terrible idea ! I spent weeks explaining to junior devs to not do that on production servers. I thought it was obvious, but apparently it isn't...

I absolutely hate that this is modus operandi for the homebrew and ruby communities. Who though that this is a good idea?

Re: Yeoman: Modern workflows for modern webapps

#25

Post by aristidb » Mon, Sep 10, 2012, 7:30 PM UTC

The installer seems to look for apt-get, yum or up2date to find out if a system runs Linux.

    $ uname
    Linux

Seriously.

Re: Yeoman: Modern workflows for modern webapps

#26

Post by paulgb » Mon, Sep 10, 2012, 7:36 PM UTC

varikin wrote: post #21

nthitz wrote: post #20

Earlier quoted context omitted.

Is it so different from running a make install or a install.sh script?

The biggest problem is validating the download prior to installing it. The use make install or install.sh or other similar script, the following should be done: Download package md5 package verify md5 == published md5 of packge extract make install / install.sh / etc With "curl package.github.com" | bash" the validation is missing. I don't mind the curl x | bash for my dev machine or testing/dev vms, but that is not…

If the bad guy has intercepted the DNS, they can just provide the md5 of the bad script, no?

Maybe the solution here, assuming you trust the third party, is for them to get a signed SSL cert and provide `curl https://get.whatever.com|bash`

Re: Yeoman: Modern workflows for modern webapps

#27

Post by borplk » Mon, Sep 10, 2012, 7:47 PM UTC

nthitz wrote: post #13

jvehent wrote: post #11

Stop doing `curl get.whatever.com|bash` ! Seriously. I have nothing against your install script, but getting devs use to that is a terrible idea ! I spent weeks explaining to junior devs to not do that on production servers. I thought it was obvious, but apparently it isn't...

Excuse the naivety but what's the issue?

Remote code execution Suppose in the install scripts there happened to be a line like "rm -rf /" then you'll feed that to bash...

Re: Yeoman: Modern workflows for modern webapps

#28

Post by commadelimited » Mon, Sep 10, 2012, 7:49 PM UTC

If you're looking for a more indepth review of Yeoman please consider checking out my article on Adobe Developer Connection:

http://www.adobe.com/devnet/html5/articles/yeoman-at-your-se...

Re: Yeoman: Modern workflows for modern webapps

#29

Post by aaronbrethorst » Mon, Sep 10, 2012, 7:49 PM UTC

    Yeoman is a robust and opinionated set of
    tools, libraries, and a workflow that can
    help developers quickly build beautiful,
    compelling web apps.

Cool, but what does it do?

Re: Yeoman: Modern workflows for modern webapps

#30

Post by tptacek » Mon, Sep 10, 2012, 7:50 PM UTC

nthitz wrote: post #20

mvanga wrote: post #15

Earlier quoted context omitted.

You are asking developers to download a shell script from $random_site and run it immediately without any thoughts whatsoever as to what effects it might have. Getting people used to that is a bad idea.

Is it so different from running a make install or a install.sh script?

No. Don't use "curl" to download install scripts from HTTP URLs, or, for that matter, from HTTPS sites you don't trust.