Seriously when people will stop using that for installation.... "curl -sL https://asciinema.org/install | sh" Still a cool product!
When there will be a better alternative.
There's no better alternative for a very good reason.
Asciinema
61–70 of 95 posts
Re: Asciinema
#62Seriously when people will stop using that for installation.... "curl -sL https://asciinema.org/install | sh" Still a cool product!
This is something I have been fighting with in my head for quite a while. "Piping shit into sh" is not really great way to do it, I fully agree. Let me describe you the situation.
At the moment there are native packages for Ubuntu/Debian (ppa) and Fedora/CentOS (in core repo). There's also homebrew package and Arch Linux one (aur). There are 2 nice guys who maintain the first two packages, doing great job, but it always takes time until the packages are ready (we're all doing it in our spare time, and there's process, especially Fedora case, which you can't skip). I maintain Arch Linux one (while not using Arch for more than few years now) but this one's usually ready on the release day.
There are no packages for other distros, but we'll never be able to provide ones for all distros (unless we're very popular project with lots of contributors). That's fine.
But there are also situations like this: https://bugs.gentoo.org/show_bug.cgi?id=532918 Let's not get into "Go packaging" discussion again, but what you can see in the mentioned Gentoo thread there's always some problem (no vendoring is bad, vendoring is bad). Sure, these guys do this too in their spare time and they don't owe me anything.
But when seeing this I'm like "oh boy, packaging is hard, I don't have time for dealing with this". So time (or lack of thereof) is one thing. Next thing is: "apt-get install asciinema" or "brew install asciinema" is awesome because it uses your software package manager and it's a single command. For all other distros (and people wanting new version right now) you can curl/sh which is equally easy. "First download this script, then review it, then run it" is not that hard but most people wouldn't review the script anyway, and those who would are the ones who are doing that now anyway. curl/sh sucks on many fronts but I made sure the script doesn't get executed when partially downloaded and it's not "| sudo sh".
I'm thinking about using one of these services which auto-build deb/rpm, they host them as apt/yum repos etc. There are few of them out there so if anyone can point me to any "proven/reliable" one I'd appreciate that. Any suggestions on the topic are welcome!
Re: Asciinema
#63Earlier quoted context omitted.
What's wrong with that? It is SSL secured. Once you agree to install software, it had local access with your accounts privileges.
We evolved packaging systems for a reason - they provide a standardized way to manage dependencies, provide clean uninstalls, etc... Having a shellscript pooping files arbitrarily into the filesystem is so 90's. Seriously - you pretty much just have to make a .dep and a .rpm and you're covered. Is that so hard?
> you pretty much just have to make a .dep and a .rpm and you're covered
Author already did that [1] and has both .deb and .rpm:
Re: Asciinema
#64Earlier quoted context omitted.
You would need to have a GPG signature with a well-known public key that is verified before executing the code.
Sorry, can you explain why? If the checksum is provided (as part of the sh snippet) by the website with the SSL certificate, isn't that enough reassurance?
If the snippet and the download are on the same site, then whoever controls that site at the moment can provide an accurate checksum of whatever malware they want to host. A signature is an improvement because it can give you some confidence that the current controller is the same as the original controller.
Re: Asciinema
#65Seriously when people will stop using that for installation.... "curl -sL https://asciinema.org/install | sh" Still a cool product!
This is something I have been fighting with in my head for quite a while. "Piping shit into sh" is not really great way to do it, I fully agree. Let me describe you the situation. At the moment there are native packages for Ubuntu/Debian (ppa) and Fedora/CentOS (in core repo). There's also homebrew package and Arch Linux one (aur). There are 2 nice guys who maintain the first two packages, doing great job, but it alw…
I added an RPM package to a project that used a Makefile to spin up a docker container which then built various packages via FPM:
https://github.com/jordansissel/fpm
I didn't use the build system heavily and it may be more overhead than you'd like but I thought it was a pretty neat way of doing things. Repo is here:
Re: Asciinema
#66Earlier quoted context omitted.
piping random shit into sh is wrong because domains go away, yet installation instructions might be repeated in countless other tutorials. easy to snap up domains and host malware. and SSL has nothing to do with it. packages are not cryptographically signed either and once on the system can easily become root.
Would this be better if the pasted command included some checksum which was checked before piping into the `sh`? Can anyone who's better at bash than me give an example of how this could work in a relatively cross-platform way?
> Would this be better if the pasted command included some checksum which was checked before piping into the `sh`?
hashpipe does exactly that:
Re: Asciinema
#67I love script[1,2] for this sort of thing. Why wait for a video to play? Or host it on a third-party site? Having the entire session visible on a single, static page is less frustrating in most circumstances I encounter. Having said that, Asciinema certainly looks like fun. [1] http://unixhelp.ed.ac.uk/CGI/man-cgi?script [2] Sample session: https://tinyapps.org/blog/nix/201107170745_copy_terminal_tex...
I was thinking the same thing... but then I realized it works, say, for an ed session, but not for a vi session. Of course, all that visual mode nonsense is just bloatware ;).
Re: Asciinema
#68Re: Asciinema
#69It's be great to have a polished product like this but for programming sessions in a text editor like Sublime.
Re: Asciinema
#70That might be against the point of this project, but I really miss the possibility of an audio-overlay. I found the demo really stress- and unhelpfull, because you have to read rockey text while typed in absolute silence… brrr. I'd rather talk while typing and explain what I am doing and have that synched to the recorded text-session.