Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gogs – Go Git Service

gogs.io

Post reply on HN
Print view View original

181–186 of 186 posts

Re: Gogs – Go Git Service

#181

Post by dragonne »

BHSPitMonkey wrote: post #176
blub wrote: post #161

Earlier quoted context omitted.

There are many that take an interest in securing their workstations, just as there are many negligent individuals who blindly run things they download from somewhere. A minimum amount of care when installing things (checking signatures/checksums, reading install scripts, etc) should be common sense and not doing that is grossly negligent.

What's the point of reading an install script if you don't also read the source of what the script is installing? That's like a proofreader only editing the intro paragraph and then signing off on the entire essay.

While I'm all for downvoting the grandparent, I'd say reading the installer script is wise even if you trust the source. Developers aren't good at shell, much less portable shell, and such scripts are usually far inferior in quality to the main application code (written in pretty much anything that's not shell). Since an installer typically manipulates privileged locations on your system it's also playing with fire. Taking few minutes to establish whether it was written competently can save a lot of pain down the road!

Re: Gogs – Go Git Service

#182

Post by BHSPitMonkey »

dragonne wrote: post #181
BHSPitMonkey wrote: post #176

Earlier quoted context omitted.

What's the point of reading an install script if you don't also read the source of what the script is installing? That's like a proofreader only editing the intro paragraph and then signing off on the entire essay.

While I'm all for downvoting the grandparent, I'd say reading the installer script is wise even if you trust the source. Developers aren't good at shell, much less portable shell, and such scripts are usually far inferior in quality to the main application code (written in pretty much anything that's not shell). Since an installer typically manipulates privileged locations on your system it's also playing with fire.…

While that's true, you can also say the same about the preinst/postinst in that .deb package hosted on someone's PPA. Also, while every .deb/.rpm must be installed using root privileges, many (not all) shell script installers don't require root and just perform a local install, making them less dangerous by nature.

Re: Gogs – Go Git Service

#183

Post by blub »

BHSPitMonkey wrote: post #176
blub wrote: post #161

Earlier quoted context omitted.

There are many that take an interest in securing their workstations, just as there are many negligent individuals who blindly run things they download from somewhere. A minimum amount of care when installing things (checking signatures/checksums, reading install scripts, etc) should be common sense and not doing that is grossly negligent.

What's the point of reading an install script if you don't also read the source of what the script is installing? That's like a proofreader only editing the intro paragraph and then signing off on the entire essay.

The point is that many install scripts do insecure things such as downloading over unencrypted channels, demand sudo without a good reason and are generally not careful to have a minimal impact to the machine.

At the minimum I want to know what it does and where it puts stuff.

This assumes that the software package itself is trusted, which is (still?) a reasonable assumption to make for open-source and big name companies.

By the way, it's poor form to downvote someone just for disagreeing with them.

Re: Gogs – Go Git Service

#184

Post by mateuszf »

andor wrote: post #139
mateuszf wrote: post #68

Earlier quoted context omitted.

The point of "run anywhere" is to not have to search for a special operating system.

I wouldn't conflate the "run anywhere" aspect with OS-level package management. How operating systems handle updates is unrelated to Java, and affects other applications on the system as well. Think about other "run anywhere" technology like Flash, PDF (Adobe Reader), Microsoft Office, Browsers -- they also don't have a great security story and need constant updates. Adobe and Sun decided to ship their software with…

> That's why distributing updates for third-party apps should be an operating system feature, as it is in all popular Linux distributions. Microsoft and Apple, please feel free to copy.

That's exactly what I meant when I said

> Yeah, the missing bit is that this should be done by OS vendors which sadly is not true.

Re: Gogs – Go Git Service

#185

Post by gizzlon »

merpnderp wrote: post #50
sytse wrote: post #18

Earlier quoted context omitted.

What can we improve in GitLab to make it better? Did the install take too long? Did you try our Omnibus packages or a source install?

I tried installing the omnibus and from source. Both times I could not get it completely working. On CentOS 5.3 x64. I eventually got everything but git commits working over ssh, but I quit trying to get that working after it looked like I had to give up port 22. I was just installing installing for evaluation and hopefully our sys admins will do the final install. Gogs was just 'install Go', 'run binary', 'link to d…

Why did you have to install Go?

Re: Gogs – Go Git Service

#186

Post by eropple »

weberc2 wrote: post #172
eropple wrote: post #158

Earlier quoted context omitted.

Did libc stop being a runtime dependency when I wasn't looking?

I don't know if libc ever was a Go dependency, but it isn't today.

I spoke imprecisely; you are correct. That said, I don't think, of the software that has escaped the Golang pits and weaseled its way into systems I am forced to maintain, any of it does not have a cgo, and thus a libc, dependency.
Post reply on HN