Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Curl 7.51.0 Released

curl.haxx.se

Post reply on HN
Print view View original

31–35 of 35 posts

Re: Curl 7.51.0 Released

#31

Post by geofft »

SFJulie wrote: post #18
du_bing wrote: post #3

What is the biggest usage of Curl? I am new to Linux,sorry.

curl is a trusted way to execute unsafe code on the internet https://gnu.moe/wallofshame.md

"curl | sh" is no worse than "wget && tar xf && ./configure". I have yet to see anyone who knows how to audit a configure script generated by GNU autoconf, which is generally a multiple-tens-of-thousands-of-line monstrosity that generates a bunch of C files and compiles and runs them. FUD about "curl | sh" isn't rooted in any sensible security modeling.

As a general rule of thumb, if you think everyone around you is independently doing something stupid, you should first pursue the hypothesis that it is your reasoning that is flawed and not the entire rest of the world's.

Re: Curl 7.51.0 Released

#32

Post by teh_klev »

LeonM wrote: post #30
teh_klev wrote: post #19

Earlier quoted context omitted.

Why repeat this here in an inferior format?

I think this format is superior for mobile users, it gives them only the relevant information in just a few kB of data. In this case, haxx.se is not that bad, but many news sites present so much ads, overlays, non-responsive UI, dark UI etc etc that most mobile browsers crash, and loading takes forever due to 10+mb of ads on a 3G connection just to display 20 lines of information.

I read this first on my android phone and can assure you that your copy paste is inferior, especially so due to the use of a fixed width font causing line truncation.

Also this kinda thing is about as popular here as "tldr" posts which are quickly suppressed.

My friendly advice is to not make a habit of this

Re: Curl 7.51.0 Released

#33

Post by sglane »

dorfsmay wrote: post #21
du_bing wrote: post #3

What is the biggest usage of Curl? I am new to Linux,sorry.

It's used to send an http/HTTPS reqeuests, controlling every aspect of it, form headers to cookies, to ignoring/not SSL certs, and has advanced debugging option to show you the entire dialog (-sv) and use a different IP address (--resolve to test you firewalls, LBs etc...).

It sure does quite a lot and I love it, but I wish it could handle SIP and WebSockets without too much trouble.

Re: Curl 7.51.0 Released

#34

Post by feld »

geofft wrote: post #31
SFJulie wrote: post #18

Earlier quoted context omitted.

curl is a trusted way to execute unsafe code on the internet https://gnu.moe/wallofshame.md

"curl | sh" is no worse than "wget && tar xf && ./configure". I have yet to see anyone who knows how to audit a configure script generated by GNU autoconf, which is generally a multiple-tens-of-thousands-of-line monstrosity that generates a bunch of C files and compiles and runs them. FUD about "curl | sh" isn't rooted in any sensible security modeling. As a general rule of thumb, if you think everyone around you is…

But you're verifying the signature of the tarball first, right?

Re: Curl 7.51.0 Released

#35

Post by geofft »

feld wrote: post #34
geofft wrote: post #31

Earlier quoted context omitted.

"curl | sh" is no worse than "wget && tar xf && ./configure". I have yet to see anyone who knows how to audit a configure script generated by GNU autoconf, which is generally a multiple-tens-of-thousands-of-line monstrosity that generates a bunch of C files and compiles and runs them. FUD about "curl | sh" isn't rooted in any sensible security modeling. As a general rule of thumb, if you think everyone around you is…

But you're verifying the signature of the tarball first, right?

Almost all of the examples on that page use curl https:// | sh. Which, again, makes it a superior option to wget && gpg --verify && ./configure; I have yet to see anyone who is better at PGP fingerprint verification than their OS's SSL stack is at TLS certificate verification. (There are a very small number of people who are as good, but not better.)
Post reply on HN