51–60 of 62 posts
> Manage your dotfiles across multiple diverse machines, securely. > $ sh -c "$(curl -fsLS https://chezmoi.io/get )" -- init --apply $GITHUB_USERNAME That this is even suggested as an installation command means that they might as well strike "securely" from the tagline. For someone interested in security the foul odor that this line emits is enough to make me stop reading.
Hmmz so with Chezmoi you can't edit your files directly... not very convenient. I'd rather use a bare Git repository : - https://www.atlassian.com/git/tutorials/dotfiles - https://www.ackama.com/what-we-think/the-best-way-to-store-y...
Earlier quoted context omitted.
I don't get the issue here. This command basically downloads and execute something. Yes, it requires you to trust the author but that's what you always need to do anyway alas you don't read and compile yourself anything you install on your computer. Or did I miss something ?
Given that this is supposed to be "secure management", one would expect something fail-safe, not fail-deadly. It also requires you to trust that the underlying http server/dns record server infrastructure did not change between runs of the command.
And what form of distribution do you propose that is secure against that?
Note also that the URL is HTTPS.
Old school guy here; there's something about using Github (as opposed to merely git) that just feels wrong. While I get the flipside, might be cool to rifle through somebody elses dotfiles to see how they do things, having your big ol' batch of configs on the "site designed for public consumption" seems weird. Especially in light of Microsoft et al perhaps not always playing nice here (see, e.g. youtube-dl)
Earlier quoted context omitted.
I felt the same way and pared down the workflow. I edit my files directly. Then when done, I do a single `chezmoi add`, which pushes it to the git repo because I have auto commit/push enabled in ~/.config/chezmoi/chezmoi.toml [git] autoCommit = true autoPush = true
Yes but this can be just a very simple (z\ba\fi)sh function. What's the point of keeping yet another tool for this?)
2 weeks ago someone asked > Ask HN: Can I see your scripts?[1] I really like this[2] solution from /u/hoechst, > Not really a script, but a `.ssh/config` to automatically deploy parts of my local cli environment to every server i connect to (if username and ip/hostname matches my rules). > On first connect to a server, this sync all the dotfiles i want to a remote host and on subsequent connects, it updates the dotfi…
I could see both being really useful. I don't want my full dotfiles available on arbitrary remote servers. But being able to setup a new dev environment by just cloning my dotfiles and linking them back is also invaluable.
I don't think that deploying all my dotfiles to a remote server is smart. But there are a few things that could be deployed that would help with quality of life.
I think this is a great way of doing that.
Hmmz so with Chezmoi you can't edit your files directly... not very convenient. I'd rather use a bare Git repository : - https://www.atlassian.com/git/tutorials/dotfiles - https://www.ackama.com/what-we-think/the-best-way-to-store-y...
That's why I use https://yadm.io It's basically a helper for a bare git repository plus some added features.
I'm still in doubt though, as git will work forever, "without" bugs, and be supported on any OS :-)
Earlier quoted context omitted.
Yes, the trust but verify step where you are supposed to check that the script you received is the one you expected.
Why is this discussion always happening when we talk about downloading and executing scripts when otoh, nobody bats an eye when you need to download and execute some binary ? I'm not saying that you should trust anything coming from anywhere, but you have no other choice than to trust the author of any software you run on your computer. Even if the Chezmoi's author was a malicious guy, why would he hide something in…
Trust seems like such an arbitrary set of lines in the sand anyway.
Adding a repo to your OS and installing the package? Fine.
Same developer provides an install script? Absolutely not.
You have to trust somebody eventually, whether it be your HW manufacturer, OS developers, packagers, developers, etc. There's a lot of it blindly going on, but a script running as your user? Just can't.
Between this and the article yesterday [1] I'm really curious what configs everyone has that they really miss when they don't have them. I know people will fight for their vim config, but what other settings do you actually care about? [1] https://news.ycombinator.com/item?id=32632533
I have a lot more stuff synced but that's one use case I rarely see mentioned if at all.
I wind up reinstalling or using new laptop/desktops all the time and its very helpful to keep things in sync. I HATE getting off my work laptop that I just spent 8 hours deving on and getting on my personal laptop and missing things. And vice versa.