I would have been interested if it was for Linux
Show HN: Laptop is the last place your secrets are still in plaintext
11–20 of 93 posts
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#12Earlier quoted context omitted.
What is wrong with it?
The pattern of piping an arbitrary script to your shell? This should be an ordinary app bundle to drop into /Applications, or be distributed as an installer. The readme even says so itself: > A bad curl | sh , a sketchy npm install, or one of the AI agents now running in your editor with your full permissions. And then, two paragraphs down, it suggests to do just that to install…
Technically this one is piping it to tar? But I agree with the sentiment.
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#13I don't know about how secure this is, but I just love the UX. Scanning and process grant are great features UX-wise.
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#14Earlier quoted context omitted.
What is wrong with it?
The pattern of piping an arbitrary script to your shell? This should be an ordinary app bundle to drop into /Applications, or be distributed as an installer. The readme even says so itself: > A bad curl | sh , a sketchy npm install, or one of the AI agents now running in your editor with your full permissions. And then, two paragraphs down, it suggests to do just that to install…
It's not piped to a shell, but to the tar program with specific parameters to directly unpack the tar.
You're still installing the program directly from github of course, instead of a source where hopefully a third party has also looked at it (like a package repository). But this is a lot better than the curl | sh pattern.
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#15Re: Show HN: Laptop is the last place your secrets are still in plaintext
#16Earlier quoted context omitted.
What is wrong with it?
The pattern of piping an arbitrary script to your shell? This should be an ordinary app bundle to drop into /Applications, or be distributed as an installer. The readme even says so itself: > A bad curl | sh , a sketchy npm install, or one of the AI agents now running in your editor with your full permissions. And then, two paragraphs down, it suggests to do just that to install…
But it’s not piping a script into the shell. It’s curl downloading a compressed archive and piping it to tar to decompress the program binary from the archive. Then moving the extracted binary into /usr/local/bin.
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#17Earlier quoted context omitted.
What is wrong with it?
The pattern of piping an arbitrary script to your shell? This should be an ordinary app bundle to drop into /Applications, or be distributed as an installer. The readme even says so itself: > A bad curl | sh , a sketchy npm install, or one of the AI agents now running in your editor with your full permissions. And then, two paragraphs down, it suggests to do just that to install…
It's curl | tar, not curl | sh
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#18Earlier quoted context omitted.
The pattern of piping an arbitrary script to your shell? This should be an ordinary app bundle to drop into /Applications, or be distributed as an installer. The readme even says so itself: > A bad curl | sh , a sketchy npm install, or one of the AI agents now running in your editor with your full permissions. And then, two paragraphs down, it suggests to do just that to install…
It's not piped to a shell, but to the tar program with specific parameters to directly unpack the tar. You're still installing the program directly from github of course, instead of a source where hopefully a third party has also looked at it (like a package repository). But this is a lot better than the curl | sh pattern.
You're not downloading from github, but from dl.jitpass.com.
And an executable can do exactly the same as a shell script. The point is that whatever you're executing isn't verified, whether it's a shell script or a binary.
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#19I would have been interested if it was for Linux
Soon, it will, yes.
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#20You can do some of this with 1Password as well btw. Looks nice!