Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yeoman: Modern workflows for modern webapps

yeoman.io

Post reply on HN
Print view View original

61–70 of 77 posts

Re: Yeoman: Modern workflows for modern webapps

#61

Post by baddox »

tptacek wrote: post #60
baddox wrote: post #41

Earlier quoted context omitted.

To be fair, if you ever install and execute someone else's software without either reading the code yourself or making an attempt to verify that the source is who you intend (i.e. at least checking MD5), then you're guilty of precisely the same security gaffe.

No, that is not precisely the same security gaffe. Github (for instance) is itself not as likely to be compromised as my link to Github is.

How do you access Github, if not through a hyperlink which is equally vulnerable to DNS spoofing?

Re: Yeoman: Modern workflows for modern webapps

#62

Post by tptacek »

baddox wrote: post #61
tptacek wrote: post #60

Earlier quoted context omitted.

No, that is not precisely the same security gaffe. Github (for instance) is itself not as likely to be compromised as my link to Github is.

How do you access Github, if not through a hyperlink which is equally vulnerable to DNS spoofing?

Neither SSL nor SSH are straightforwardly susceptible to DNS spoofing.

Re: Yeoman: Modern workflows for modern webapps

#64

Post by petercooper »

ominous_prime wrote: post #24
jvehent wrote: post #11

Stop doing `curl get.whatever.com|bash` ! Seriously. I have nothing against your install script, but getting devs use to that is a terrible idea ! I spent weeks explaining to junior devs to not do that on production servers. I thought it was obvious, but apparently it isn't...

I absolutely hate that this is modus operandi for the homebrew and ruby communities. Who though that this is a good idea?

Anyone who values the user experience over the tiny chance of a security breach.

I'm not validating it as a good practice, but that seems to be the main reason and I've not heard of Pow or Homebrew causing any problems in this regard.. yet ;-)

Re: Yeoman: Modern workflows for modern webapps

#65

Post by tucson »

ricardobeat wrote: post #46
tucson wrote: post #40

Earlier quoted context omitted.

Can this tool connect to a mysql database and generate html5 CRUD forms based on the database? I have seen a tool like phreeze.com and I am wondering why there is not more in that direction (building web app basic pages based on existing database design)?

This is a tool for front-end developers. It would have to support a myriad of server-side languages for that, which is completely out of scope, and tools that do it already exist.

> "and tools that do it already exist" Which are those tools?

Re: Yeoman: Modern workflows for modern webapps

#66

Post by Kudos »

grannyg00se wrote: post #39
jvehent wrote: post #11

Stop doing `curl get.whatever.com|bash` ! Seriously. I have nothing against your install script, but getting devs use to that is a terrible idea ! I spent weeks explaining to junior devs to not do that on production servers. I thought it was obvious, but apparently it isn't...

Isn't that just a suggestion to get up and running quickly (for example on a dev VM)? There's nobody forcing devs to blindly follow the instruction and pipe it directly into bash. You are free to curl -L -o install.sh get.whatever.com if you want to inspect the install script.

> There's nobody forcing devs to blindly follow the instruction and pipe it directly into bash

"Nobody's forcing you" is the weakest argument.

Re: Yeoman: Modern workflows for modern webapps

#68

Post by Wilya »

aristidb wrote: post #55
ranza wrote: post #48

Earlier quoted context omitted.

Its using that later for installing packages using its native package system

If I understand the code right, it only installs things automatically when it detects homebrew. Besides, it _assumes you're on a Mac_ if none of these three programs are found.

From what I can guess, if you happen to be on a non-supported linux distribution (or any non-OSX OS with sh, really) and have clang installed, the script will go as far as running https://raw.github.com/mxcl/homebrew/go which should fail fast for lack of a /usr/bin/sw_vers binary.

I'm not brave enough to actually run the script and check, though.

Re: Yeoman: Modern workflows for modern webapps

#69

Post by ricardobeat »

tucson wrote: post #65
ricardobeat wrote: post #46

Earlier quoted context omitted.

This is a tool for front-end developers. It would have to support a myriad of server-side languages for that, which is completely out of scope, and tools that do it already exist.

> "and tools that do it already exist" Which are those tools?

rails/cake/etc: http://en.wikipedia.org/wiki/Scaffold_(programming)

Re: Yeoman: Modern workflows for modern webapps

#70

Post by StavrosK »

petercooper wrote: post #64
ominous_prime wrote: post #24

Earlier quoted context omitted.

I absolutely hate that this is modus operandi for the homebrew and ruby communities. Who though that this is a good idea?

Anyone who values the user experience over the tiny chance of a security breach. I'm not validating it as a good practice, but that seems to be the main reason and I've not heard of Pow or Homebrew causing any problems in this regard.. yet ;-)

Never mind the security aspect, how am I going to uninstall the damn thing or upgrade its components (which other things in my system might use) with a custom installer?

There's a reason I don't install things that don't use apt.

Post reply on HN