Conversation

Notices

1. rain (rain@niu.moe)'s status on Wednesday, 17-Jul-2019 13:30:44 EDT rain

   that people will argue in favor of curl | bash shows how absolutely fucked our entire software infra is

   1. codesections (codesections@fosstodon.org)'s status on Wednesday, 17-Jul-2019 16:32:34 EDT codesections

      in reply to

      @rain

      > that people will argue in favor of curl | bash shows how absolutely fucked our entire software infra is

      I *generally* agree, but I'm willing to make a partial exception for extremely large/established/reputable projects (assuming that the download is over https).

      For example, the recommended installation method for #rust starts with a `curl | sh` command, and I don't really have a problem with that (though I'm glad they give other options) https://www.rust-lang.org/tools/install

      1. Daniel Taylor (randomdamage@mastodon.technology)'s status on Wednesday, 17-Jul-2019 17:15:07 EDT Daniel Taylor

         in reply to

         @codesections @rain it's even worse for a "reputable project" to do this, because that justifies it for everyone else.

         Just don't. It's an anti-pattern, even with https.

         Worse than pre-compiled binaries from a common pool.

   2. Digital Mark 800 48K GTIA (mdhughes@cybre.space)'s status on Wednesday, 17-Jul-2019 14:47:34 EDT Digital Mark 800 48K GTIA

      in reply to

      @rain It's not really any worse than git clone xxx;./configure; make; sudo make install

      Software is bad and sharing is dangerous.

      1. Daniel Taylor (randomdamage@mastodon.technology)'s status on Wednesday, 17-Jul-2019 17:16:38 EDT Daniel Taylor

         in reply to

         @mdhughes @rain leave out the semicolons.

         Seriously, do people actually *do* this?