Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Install.md: A standard for LLM-executable installation

mintlify.com

Post reply on HN
Print view View original

51–60 of 124 posts

Re: Install.md: A standard for LLM-executable installation

#51

Post by andai »

rvz wrote: post #3
dang wrote: post #69

[stub for offtopicness] Since the article has been changed to tone down its provocative opener, which clearly had a kicking-the-anthill effect, I'm moving those original reactions to this subthread.

This has to be a joke right? > Installing software is a task which should be left to AI. Absolutely I don't think so. This is a very bad idea. $ curl | bash was bad enough. But $ curl -fsSL | claude looks even worse. What could possibly go wrong?

I gave Claude root to my $3 VPS and I'm delighted to have a server that "configures itself."

I wouldn't use it for anything serious, but that being said, I think it's in better shape than when I was running it.

Re: Install.md: A standard for LLM-executable installation

#52

Post by petekoomen »

I'm seeing a lot of negativity in the comments. Here's why I think this is actually a Good Idea. Many command line tools rely on something like this for installation:

  $ curl -fsSL https://bun.com/install | bash
This install script is hundreds of lines long and difficult for a human to audit. You can ask a coding agent to do that for you, but you still need to trust that the authors haven't hidden some nefarious instructions for an LLM in the middle of it.

On the other hand, an equivalent install.md file might read something like this:

Install bun for me.

Detect my OS and CPU architecture, then download the appropriate bun binary zip from GitHub releases (oven-sh/bun). Use the baseline build if my CPU doesn't support AVX2. For Linux, use the musl build if I'm on Alpine. If I'm on an Intel Mac running under Rosetta, get the ARM version instead.

Extract the zip to ~/.bun/bin, make the binary executable, and clean up the temp files.

Update my shell config (.zshrc, .bashrc, .bash_profile, or fish http://config.fish depending on my shell) to export BUN_INSTALL=~/.bun and add the bin directory to my PATH. Use the correct syntax for my shell.

Try to install shell completions. Tell me what to run to reload my shell config.

It's much shorter and written in english and as a user I know at a glance what the author is trying to do. In contrast with install.sh, install.md makes it easy for the user to audit the intentions of the programmer.

The obvious rebuttal to this is that if you don't trust the programmer, you shouldn't be installing their software in the first place. That is, of course, true, but I think it misses the point: that coding agents can act as a sort of runtime for prose and as a user the loss in determinism and efficiency that this implies is more than made up for by the gain in transparency.

Re: Install.md: A standard for LLM-executable installation

#53

Post by smaudet »

petekoomen wrote: post #52

I'm seeing a lot of negativity in the comments. Here's why I think this is actually a Good Idea. Many command line tools rely on something like this for installation: $ curl -fsSL https://bun.com/install | bash This install script is hundreds of lines long and difficult for a human to audit. You can ask a coding agent to do that for you, but you still need to trust that the authors haven't hidden some nefarious instr…

> This install script is hundreds of lines long

Any script can be shortened by hiding commands in other commands.

LLMs run parameters in the billions.

Lines of code, as usual, is an incredibly poor metric to go by here.

Re: Install.md: A standard for LLM-executable installation

#54

Post by petekoomen »

smaudet wrote: post #53
petekoomen wrote: post #52

I'm seeing a lot of negativity in the comments. Here's why I think this is actually a Good Idea. Many command line tools rely on something like this for installation: $ curl -fsSL https://bun.com/install | bash This install script is hundreds of lines long and difficult for a human to audit. You can ask a coding agent to do that for you, but you still need to trust that the authors haven't hidden some nefarious instr…

> This install script is hundreds of lines long Any script can be shortened by hiding commands in other commands. LLMs run parameters in the billions. Lines of code, as usual, is an incredibly poor metric to go by here.

My point is not that LLMs are inherently trustworthy. It is that a prompt can make the intentions of the programmer clear in a way that is difficult to do with code because code is hard to read, especially in large volumes.

Re: Install.md: A standard for LLM-executable installation

#55

Post by jedwhite »

I shared a repo on HN last week that lets you use remote execution with these kinds of script files autonomously - if you want to. It had some interesting negative and positive discussion.

The post mentioned Pete Koomen's install.md idea as an example use case. So now with this launch you can try it with a real intstallation script!

I think it's a really interesting idea worth experimentation and exploration. So it's a positive thing to see Mintlify launch this, and that it's already on Firecrawl.dev's docs!

We can all learn from it.

Show HN discussion of executable markdown here:

https://news.ycombinator.com/item?id=46549444

The claude-run tool lets you execute files like this autonomously if you want to experiment with it.

    curl -fsSL https://docs.firecrawl.dev/install.md | claude-run --permission-mode bypassPermissions
Github repo:

https://github.com/andisearch/claude-switcher

This is still a very early-stage idea, but I'm really stoked to see this today. For anyone interested in experimenting with it, it's a good idea to try in a sandboxed environment.

Re: Install.md: A standard for LLM-executable installation

#56

Post by dang »

vimda wrote: post #14
dang wrote: post #69

[stub for offtopicness] Since the article has been changed to tone down its provocative opener, which clearly had a kicking-the-anthill effect, I'm moving those original reactions to this subthread.

[flagged]

"Don't be snarky."

"Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something."

"Don't be curmudgeonly. Thoughtful criticism is fine, but please don't be rigidly or generically negative."

https://news.ycombinator.com/newsguidelines.html

Re: Install.md: A standard for LLM-executable installation

#57

Post by skeptrune »

rarisma wrote: post #45

Great, I can now combine the potential maliciousness of a script with the potential vulnerabilities of an AI Agent! Jokes aside, this seems like a really wierd thing to leave to agents; I'm sure its definitely useful but how exactly is this more secure, a bad actor could just prompt inject claude (an issue I'm not sure can ever be fixed with our current model of LLMs). And surely this is significantly slower than a s…

This is some really fantastic feedback, thank you!

I personally think that prose is significantly easier to read than complex bash and there are at least some benefits to it. They may not outweigh the cons, but it's interesting to at least consider.

That said, this is a proposal and something we plan to iterate on. Generating install.sh scripts instead of markdown is something we're at least thinking about.

Re: Install.md: A standard for LLM-executable installation

#58

Post by blast »

petekoomen wrote: post #52

I'm seeing a lot of negativity in the comments. Here's why I think this is actually a Good Idea. Many command line tools rely on something like this for installation: $ curl -fsSL https://bun.com/install | bash This install script is hundreds of lines long and difficult for a human to audit. You can ask a coding agent to do that for you, but you still need to trust that the authors haven't hidden some nefarious instr…

Why the specific application to install scripts? Doesn't your argument apply to software in general?

(I have my own answer to this but I'd like to hear yours first!)

Re: Install.md: A standard for LLM-executable installation

#59

Post by bigbuppo »

skeptrune wrote: post #32
wrigby wrote: post #30

Earlier quoted context omitted.

Or just, I don’t know… package your software?

Intent here is that this would be adopted by more difficult to install devtools which are unpackaged to the extent that you need a dependency like a specific version of Node, Python, or a dev lib.

I think you want docker?

Re: Install.md: A standard for LLM-executable installation

#60

Post by petekoomen »

blast wrote: post #58
petekoomen wrote: post #52

I'm seeing a lot of negativity in the comments. Here's why I think this is actually a Good Idea. Many command line tools rely on something like this for installation: $ curl -fsSL https://bun.com/install | bash This install script is hundreds of lines long and difficult for a human to audit. You can ask a coding agent to do that for you, but you still need to trust that the authors haven't hidden some nefarious instr…

Why the specific application to install scripts? Doesn't your argument apply to software in general? (I have my own answer to this but I'd like to hear yours first!)

It does, and possibly this launch is a little window into the future!

Install scripts are a simple example that current generation LLMs are more than capable of executing correctly with a reasonably descriptive prompt.

More generally, though, there's something fascinating about the idea that the way you describe a program can _be_ the program that tbh I haven't fully wrapped my head around, but it's not crazy to think that in time more and more software will be exchanged by passing prompts around rather than compiled code.

Post reply on HN