21–30 of 38 posts
What kind of title is this? "Evil Open Source". It has nothing to do with the content. The linked post itself is titled "OMG rm -rf ~ in a valentine bash script and its partly my fault??!?!"
Furthermore, I can't possibly audit every single line of every open source project I run on my personal machine. Did you review every line of the last distro you installed? A python package installed via pip can just as easily 'rm -r ~' as a bash script can, as can a vim plugin, etc. etc. In the end, it often comes down to trust, and credibility.
What have you done to yours?
It's a shame, the fact that he decided to rm -rf ~ has hijacked the point he was trying to make in the first place. Now everyone's discussing if there's a better way of making his point rather than downloading random scripts on the internet and running them. And the dramatic irony is: he tried to warn people that bad things can happen if they run scripts without verifying... by doing _exactly_ what he is warning abou…
The repo owner was stupid for not checking what they were merging, and the author is stupid for making the pull request in the first place. If they wanted to prove a point, they should have merged something a little less harmful, like "echo This file could have deleted your home folder. Don't run random scripts from the Internet without inspecting them first."
Right. If you are going to troll, do it with something annoying but harmless: download and play an audio file, lock the screen so they have to sign in again, pop open 100 gnome-shells, etc.
What kind of title is this? "Evil Open Source". It has nothing to do with the content. The linked post itself is titled "OMG rm -rf ~ in a valentine bash script and its partly my fault??!?!"
What's with "partly" anyway? More like "entirely", regardless of the muppet conspirancy theory
Meanwhile, merging that pull request seems downright stupid, but maybe there are mitigating factors I'm not aware of?
"In a fit of silliness" No. Not silly. Not at all. "I think I was the muppet they got to pull the trigger of the gun they pointed." Amazing. ~They got me to pull the trigger.~ ~I'm just a muppet.~ No. Not a muppet. Not at all. Sickening.
If anything is sickening, it's this readiness to assign blame and exaggerate guilt.
"In a fit of silliness" No. Not silly. Not at all. "I think I was the muppet they got to pull the trigger of the gun they pointed." Amazing. ~They got me to pull the trigger.~ ~I'm just a muppet.~ No. Not a muppet. Not at all. Sickening.
Stop being a judgemental ass. He expected the pull request to be read and ignored, not blindly (or maliciously) merged. If anything is sickening, it's this readiness to assign blame and exaggerate guilt.
This is one of my pet peeves of late - so many tools and tutorials advise the user to curl and pipe some script of the net to install and make it work. Why aren't we teaching people to be a little cautious - to download, review and then install? How did developers become so lazy, and so coddled that we desire convenience over security or forethought? Or worse, is it really due to an increasing number of developers wh…
That's accomplished by the author publishing a sha256 hash and me following this workflow:
curl http://scriptname > scriptname.foo
sha256 scriptname # visually verify that it looks right from the web site
chmod 755
./scriptname.foo
Note that, e.g., Calibre, has their Linux update procedure to be as follows[1]:
sudo python -c "import sys; py3 = sys.version_info[0] > 2; u = __import__('urllib.request' if py3 else 'urllib', fromlist=1); exec(u.urlopen('http://status.calibre-ebook.com/linux_installer').read()); main()"
To decode the Python: that command/script downloads a script from the internet without verification, and executes it as root.