31–40 of 87 posts
Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
Everyone says this, but nearly nobody does it. Just like security through open source, it's more a nice myth than a reality.
If only there was a way to transactionally run shell scripts such that if they don't complete fully, the changes are automatically reverted. Edit: cue the HN responses to use nix, and other solutions
Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
While I agree, how does this mesh with standard operating procedure on Windows/Mac being to download binary executables and run them? Is the analogous advice "inspect any exe files with Ghidra and fully understand them before running"? Or "only run executables from official distribution channels of open source projects the code of which you've read and understand"? Where, generally, should we place our trust in terms…
Basically, if you believe that code signing is a good thing (and I hope we all can agree on that), curl to shell is not great security practice.
How is it possible that there are ELEVEN different possible package managers that need to be supported by an installation script like this?
I can understand that some divergences in philosophical or concrete requirements could lead to two, three, or four opinionated varieties, but ELEVEN?
Does that mean that if I want to write an app that runs on Linux I should also be seeking to support 11 package managers? Or is there something unique about tailscale that would necessitate it?
edit: Thank you for the responses so far, but noone has yet answered the core question: WHY are there eleven of them?
Earlier quoted context omitted.
Thats who pushed XZ out as far as it went. Everyone is asleep at the wheel.
A single incident. How many incidents in how many decades have there been?
A fair number of upstream developers are unhappy with what maintainers and how they deal with bugs and updates.
The real problem is that software packaging and distribution is so very broken. I had a systems admin say "I love containers, they are a circle of salt around demonically bad software"... He wasnt wrong.
Earlier quoted context omitted.
Didn't the xz situation kinda prove that even reading the script is probably not gonna do you a lot of good if you're up against someone smart?
The xz situation proved the opposite: if you're up against someone smart, you won't read the script (and you'll think you have).
I read TFA. Why would a truncated partial download happen and still run the script?
I read TFA. Why would a truncated partial download happen and still run the script?
A serious question for any Linux-heads here, no insult intended. How is it possible that there are ELEVEN different possible package managers that need to be supported by an installation script like this? I can understand that some divergences in philosophical or concrete requirements could lead to two, three, or four opinionated varieties, but ELEVEN? Does that mean that if I want to write an app that runs on Linux…
The rest should be done by the distros' maintainers.