Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Ultimate Vim Distribution

vim.spf13.com

Post reply on HN
Print view View original

51–60 of 90 posts

Re: The Ultimate Vim Distribution

#51

Post by jlgreco »

erydo wrote: post #44
njharman wrote: post #35

> curl http://j.mp/spf13-vim3 -L -o - | sh I'm stunned that anyone would pipe from internet to shell. No SSL and redirecting just make it easier for the bad guy. It makes me angry that people are promoting this as an install method. Like suggesting your first name as a good password.

Ignoring the SSL bit, from a security standpoint is piping to the shell really any different than saying "run this installer application"? Either way you're allowing the source to run arbitrary commands on your computer.

The problem is that it blurs the line between what is safe, and what is not safe.

It is basically the difference between telling your users to do:

  wget example.com/some_script.sh ; chmod +x some_script.sh ; ./some_script.sh
and:

  wget example.com/some_script.sh
  chmod +x some_script.sh
  ./some_script.sh
A good engineer will tell you that those two things are exactly the same. The reality however is that they really are not. The first is a single cohesive unit of work, from the perspective of the user. It is "easier", even though you could copy/paste the second example just as easily. The second is clearly three units of work. The story is the same, but the runon sentences have been removed. The user is almost forced to, subconsciously, ponder each step: First we download this, then we run it. Why the separation?

It is about reenforcing deliberate actions. Discrete options give the user time to interject their own thoughts.

If that isn't something that we value, then we should stop half-assing it and just give wget or curl an 'execute' flag.

Re: The Ultimate Vim Distribution

#52

Post by johncoltrane »

mcrittenden wrote: post #9
andyl wrote: post #5

Like everything except vundle. (I use tpope's pathogen) Pre-packaged vim on github is a very nice way to distribute.

I'm curious as to why you (or anyone) would prefer pathogen to vundle? Vundle just seems like pathogen except with less manual work.

1. I switch to another tool if and when I have problems with my current tool. Because Pathogen has served me well for the last two years there's no reason to switch to Vundle or some other plugin manager.

2. Vundle is too heavily Git/Github-centered for my taste.

Re: The Ultimate Vim Distribution

#54

Post by erydo »

dredmorbius wrote: post #50
erydo wrote: post #44

Earlier quoted context omitted.

Ignoring the SSL bit, from a security standpoint is piping to the shell really any different than saying "run this installer application"? Either way you're allowing the source to run arbitrary commands on your computer.

Yes. For me to trust an installer, implicitly, it's best for it to be part of my software distribution's package management system. This means that the package is signed and checksummed, it's included in the distro's bugtracking system, and is being downloaded from a known set of mirrors. Your next best option is to provide a download, checksums, and signatures, with a well-signed PGP/GPG key. At this point I can at…

First: I'm not recommending anything—I'm asking a question. This isn't my practice but it's important to play devil's advocate sometimes.

Second, the question was not whether piping to shell is a good way of doing installations. The question was whether it's actually worse than the common method of offering up an untrusted downloadable executable.

Many (or most) consumer software downloads that you'll find for Mac or Windows don't meet any of the criteria you specified (which I agree are good criteria). But that wasn't the question: Is it actually worse than offering an untrusted executable? People don't seem to complain about those as much, but to me they seem equivalently bad.

Re: The Ultimate Vim Distribution

#55

Post by JonnieCache »

jlgreco wrote: post #19
neeee wrote: post #17

Earlier quoted context omitted.

Have you looked at prezto[1]? It encourages forking and in-place editing strongly, and everything is a module. [1] https://github.com/sorin-ionescu/prezto

I'll check that out, thanks. My zsh setup has been pretty stagnant for a while now, probably about time I gave it some love.

In case it isn't clear, prezto is a fork of oh-my-zsh which has basically been rewritten bit by bit to make everything much cleaner and saner. I highly recommend it. The history-substring-search and syntax-highlighting modules are brilliant. You will be the envy of all your friends and neighbours.

Re: The Ultimate Vim Distribution

#56

Post by johncoltrane »

Yet another set nocompatible. In "The Ultimate Vim Distribution", no less.

I can't understand why anybody would want to use that kind of "distribution". All the vimrc tweaking and plugin dance is actually very beneficial in the first few months because it forces beginners to learn a lot of basics and, above all, how to use the help. And, well… experienced users already have a vimrc tweaked to hell and their own set of plugins.

Re: The Ultimate Vim Distribution

#57

Post by dredmorbius »

erydo wrote: post #54
dredmorbius wrote: post #50

Earlier quoted context omitted.

Yes. For me to trust an installer, implicitly, it's best for it to be part of my software distribution's package management system. This means that the package is signed and checksummed, it's included in the distro's bugtracking system, and is being downloaded from a known set of mirrors. Your next best option is to provide a download, checksums, and signatures, with a well-signed PGP/GPG key. At this point I can at…

First: I'm not recommending anything—I'm asking a question. This isn't my practice but it's important to play devil's advocate sometimes. Second, the question was not whether piping to shell is a good way of doing installations. The question was whether it's actually worse than the common method of offering up an untrusted downloadable executable. Many (or most) consumer software downloads that you'll find for Mac or…

At the very least, pipe-to-shell means you're left without an audit trail, if you're actually practicing that method.

With a downloadable executable or installer, I'm left with a file that I can save, checksum, scan for vulnerabilities, and/or refer to at a later date should I find that there are concerns I didn't discover initially.

curl-pipe-bash, especially in the absence of SSL/TLS, leaves me vulnerable to injection attacks, as well as invisible changes to the installer (so I don't know whether or not things have changed if I'm trying the same process later).

It's a very, very, very bad idea.

My prediction: this will all end in tears sooner or later. I'm actually hoping for sooner just so we can put an end to this foolishness.

As for Windows: I don't play there often, but my understanding is that most executables are now signed, so that the "download random binary from arbitrary website, run as Administrator" practice is at least very slightly less batshit insane than in the past.

Re: The Ultimate Vim Distribution

#58

Post by dredmorbius »

spf13 wrote: post #36
njharman wrote: post #35

> curl http://j.mp/spf13-vim3 -L -o - | sh I'm stunned that anyone would pipe from internet to shell. No SSL and redirecting just make it easier for the bad guy. It makes me angry that people are promoting this as an install method. Like suggesting your first name as a good password.

If you have any concerns there are also manual install instructions. SSL is a good idea. I should absolutely switch over to that.

Here's my suggestion:

Post the manual installer methods.

Post checksums.

Sign your checksums.

Re: The Ultimate Vim Distribution

#59

Post by sigzero »

olalonde wrote: post #13
exogen wrote: post #11

I realize this is a different project, but since it looks similar: installing Janus was the worst decision I ever made while looking to improve my Vim experience. It actually made Vim worse , sometimes by just slowing things down, other times because of the lack of quality control in the bundled plugins. One plugin actually caused data loss many times – it completely froze the editor when a certain syntax pattern was…

I think you are an exception. I can't get anything done with vanilla Vim (no smart indentation for instance) and install Janus anytime I need to use Vim on a new shell.

A couple of lines in your .vimrc and boom you have that and more.

Re: The Ultimate Vim Distribution

#60

Post by adhipg »

wahnfrieden wrote: post #26
DiabloD3 wrote: post #20

Earlier quoted context omitted.

I dunno, I had problems trying to make it do something, but I forget what. I almost want to say it was git submodule related, but it was like a year or more ago.

If I'm not mistake, vundle doesn't use git submodules, pathogen does.

Why would you need submodule support with vundle? With vundle you don't even need to have your .vim directory as a part of the 'dotFiles' repository - it just accepts a list of plugin (github/vimscript/whatever) urls that you want to install.
Post reply on HN