Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Install.md: A standard for LLM-executable installation

mintlify.com

Post reply on HN
Print view View original

71–80 of 124 posts

Re: Install.md: A standard for LLM-executable installation

#71

Post by cuu508 »

petekoomen wrote: post #52

I'm seeing a lot of negativity in the comments. Here's why I think this is actually a Good Idea. Many command line tools rely on something like this for installation: $ curl -fsSL https://bun.com/install | bash This install script is hundreds of lines long and difficult for a human to audit. You can ask a coding agent to do that for you, but you still need to trust that the authors haven't hidden some nefarious instr…

IMO it's completely the other way around.

Shell scripts can be audited. The average user may not do it due to laziness and/or ignorance, but it is perfectly doable.

On the other hand, how do you make sure your LLM, a non-deterministic black box, will not misinterpret the instructions in some freak accident?

Re: Install.md: A standard for LLM-executable installation

#72

Post by lcnmrn »

imiric wrote: post #42

Here's a proposal: app.md. A structured text file with everything you want your app to do. That way we can have entire projects with nothing but Markdown files. And we can run apps with just `claude run app.md`. Who needs silly code anyway?

It will produce a different app every single time. :)

Re: Install.md: A standard for LLM-executable installation

#73

Post by Szpadel »

petekoomen wrote: post #52

I'm seeing a lot of negativity in the comments. Here's why I think this is actually a Good Idea. Many command line tools rely on something like this for installation: $ curl -fsSL https://bun.com/install | bash This install script is hundreds of lines long and difficult for a human to audit. You can ask a coding agent to do that for you, but you still need to trust that the authors haven't hidden some nefarious instr…

imagine such support ticket:

I used minimax M2 (context it's very unreliable) for installation and it didn't work and my document folder is missing, help

how do you even debug this? imagine you some path or behaviour is changed in new os release and model thinks it knows better? if anything goes wrong who is responsible?

Re: Install.md: A standard for LLM-executable installation

#74

Post by PunchyHamster »

petekoomen wrote: post #52

I'm seeing a lot of negativity in the comments. Here's why I think this is actually a Good Idea. Many command line tools rely on something like this for installation: $ curl -fsSL https://bun.com/install | bash This install script is hundreds of lines long and difficult for a human to audit. You can ask a coding agent to do that for you, but you still need to trust that the authors haven't hidden some nefarious instr…

you assume 2 things: that the instructions will be followed correctly, and that the way they will be followed won't change with agent change

Neither of those things is actually true

People that got their home dir removed by AI agent did not ask for their home dir being removed by AI

Re: Install.md: A standard for LLM-executable installation

#75

Post by jen20 »

petekoomen wrote: post #52

I'm seeing a lot of negativity in the comments. Here's why I think this is actually a Good Idea. Many command line tools rely on something like this for installation: $ curl -fsSL https://bun.com/install | bash This install script is hundreds of lines long and difficult for a human to audit. You can ask a coding agent to do that for you, but you still need to trust that the authors haven't hidden some nefarious instr…

This seems like an incredibly long winded, risky and inefficient way to install bun.

I've never actually (knowingly) run Bun before, but decided to give it a try - below is my terminal session to get it running (on macOS):

    $ nix-shell -p bun
    
    [nix-shell:~]$ bun
    Bun is a fast JavaScript runtime, package manager, bundler, and test
    runner. (1.3.5+1e86cebd7)
    
    Usage: bun  [...flags] [...args]
    
    Commands:
      run       ./my-script.ts       Execute a file with Bun
                lint                 Run a package.json script
    ... (rest of output trimmed)...
(Edited to wrap a long preformatted line)

Re: Install.md: A standard for LLM-executable installation

#76

Post by catlifeonmars »

petekoomen wrote: post #52

I'm seeing a lot of negativity in the comments. Here's why I think this is actually a Good Idea. Many command line tools rely on something like this for installation: $ curl -fsSL https://bun.com/install | bash This install script is hundreds of lines long and difficult for a human to audit. You can ask a coding agent to do that for you, but you still need to trust that the authors haven't hidden some nefarious instr…

This seems less auditable though, because now there is more variability in the way something is installed. Now there are two layers to audit:

- What the agent is told to do in prose

- How the agent interprets those instructions with the particular weights/contexts/temperature at the moment.

I’m all for the prose idea, but wouldn’t want to trade determinism for it. Shell scripts can be statically analyzed. And also reviewed. Wouldn’t a better interaction be to use an LLM to audit the shell script, then hash the content?

Re: Install.md: A standard for LLM-executable installation

#77

Post by gitaarik »

lcnmrn wrote: post #72
imiric wrote: post #42

Here's a proposal: app.md. A structured text file with everything you want your app to do. That way we can have entire projects with nothing but Markdown files. And we can run apps with just `claude run app.md`. Who needs silly code anyway?

It will produce a different app every single time. :)

Sounds like fun!

Re: Install.md: A standard for LLM-executable installation

#78

Post by catlifeonmars »

petekoomen wrote: post #54
smaudet wrote: post #53

Earlier quoted context omitted.

> This install script is hundreds of lines long Any script can be shortened by hiding commands in other commands. LLMs run parameters in the billions. Lines of code, as usual, is an incredibly poor metric to go by here.

My point is not that LLMs are inherently trustworthy. It is that a prompt can make the intentions of the programmer clear in a way that is difficult to do with code because code is hard to read, especially in large volumes.

I’m not sure I agree with you that code is hard to read. I usually tend to go straight to the source code as it communicates precisely how something will behave. Well written code, like well written prose can also communicate intent effectively.

Re: Install.md: A standard for LLM-executable installation

#79

Post by nobodywillobsrv »

cuu508 wrote: post #71
petekoomen wrote: post #52

I'm seeing a lot of negativity in the comments. Here's why I think this is actually a Good Idea. Many command line tools rely on something like this for installation: $ curl -fsSL https://bun.com/install | bash This install script is hundreds of lines long and difficult for a human to audit. You can ask a coding agent to do that for you, but you still need to trust that the authors haven't hidden some nefarious instr…

IMO it's completely the other way around. Shell scripts can be audited. The average user may not do it due to laziness and/or ignorance, but it is perfectly doable. On the other hand, how do you make sure your LLM, a non-deterministic black box, will not misinterpret the instructions in some freak accident?

How about both worlds?

Instead of asking the agent to execute it for you, you ask the agent to write an install.sh based on the install.md?

Then you can both audit whatever you want before running or not.

Re: Install.md: A standard for LLM-executable installation

#80

Post by verdverm »

skeptrune wrote: post #37
0o_MrPatrick_o0 wrote: post #36

Author should explore Ansible/Puppet/Chef. I’m not sure this solution is needed with frontier models.

Can you explain more? I see how those relate to a very limited extent, but I'm not getting your entire vision.

Installing software should be deterministic and auditable. We have many decades of tool building in devops to facilitate this. It's bonkers to throw that all out for Markdown and LLMs.

Instead, have your LLMs write inputs to those tools. It's an easier task for them anyway and they only have to do it once, then you just run it

Post reply on HN