I was about to write few blog post about hacking some websites and servers, now it's pretty cool to record live and post later to blog.
Asciinema
31–40 of 95 posts
Re: Asciinema
#32This is very cool. I'd love to adapt it to help members of my team collaborate and share workflows, but GPL makes it hard to integrate with any internal tooling.
Should be fine as long as you're not distributing binaries, and the code stays internal.
Re: Asciinema
#33Earlier quoted context omitted.
piping random shit into sh is wrong because domains go away, yet installation instructions might be repeated in countless other tutorials. easy to snap up domains and host malware. and SSL has nothing to do with it. packages are not cryptographically signed either and once on the system can easily become root.
Once you've installed it you've given local privileges (or even root) to the app, so you're hosed anyway.
I think the bigger danger is that since you're instructing a direct pipe-to-sh over the network without regard to exit status, you're running the risk of executing truncated code that could trash your system state.
Re: Asciinema
#34Earlier quoted context omitted.
What's wrong with that? It is SSL secured. Once you agree to install software, it had local access with your accounts privileges.
piping random shit into sh is wrong because domains go away, yet installation instructions might be repeated in countless other tutorials. easy to snap up domains and host malware. and SSL has nothing to do with it. packages are not cryptographically signed either and once on the system can easily become root.
Would this be better if the pasted command included some checksum which was checked before piping into the `sh`? Can anyone who's better at bash than me give an example of how this could work in a relatively cross-platform way?
Re: Asciinema
#35I was really hoping this was short animated clips of famous movie scenes rendered in ASCII.
Re: Asciinema
#36Earlier quoted context omitted.
What's wrong with that? It is SSL secured. Once you agree to install software, it had local access with your accounts privileges.
piping random shit into sh is wrong because domains go away, yet installation instructions might be repeated in countless other tutorials. easy to snap up domains and host malware. and SSL has nothing to do with it. packages are not cryptographically signed either and once on the system can easily become root.
If you are doing a terminal video, I'm pretty sure you are smart enough to break down that pipe and first download, and then run it.
Re: Asciinema
#37Looks great. But I think quite a few people (the audience with which the recording would be shared) would like to see the entire session at once instead of watching the entire video. It would also be helpful for the writer to quickly verify if they missed something.
Re: Asciinema
#38Earlier quoted context omitted.
Once you've installed it you've given local privileges (or even root) to the app, so you're hosed anyway.
I think the bigger danger is that since you're instructing a direct pipe-to-sh over the network without regard to exit status, you're running the risk of executing truncated code that could trash your system state.
The author addresses this issue by wrapping the script [1] in {} braces:
{ # Prevent execution if this script was only partially downloaded
# installation code here
} # End of wrapping
Re: Asciinema
#39Re: Asciinema
#40Earlier quoted context omitted.
piping random shit into sh is wrong because domains go away, yet installation instructions might be repeated in countless other tutorials. easy to snap up domains and host malware. and SSL has nothing to do with it. packages are not cryptographically signed either and once on the system can easily become root.
If you are doing a terminal video, I'm pretty sure you are smart enough to break down that pipe and first download, and then run it.
So why not make that the way the instructions tell you to do it?