Visit Homebrew, Rustup, Oh My Zsh, nvm and few other popular open source projects website and you realise that quietly `curl -fsSL` has become the most popular package manager for Linux and Unix users 😂 How did we get here ?
-
@nixCraft i hate it when that's the only option. I often try to read the script itself and it's an obtuse mess.
@jbaert @nixCraft It has become indeed quite common that I often don't want to read / check the script once again. Instead I run the curl in a pod and then copy the artifact to my system.
Where did we go wrong? Probably too many different package managers out there and/or too little time to maintain them. Even if they make an rpm /deb pkg, what guarantee you have nothing fishy happens in the postinstall?
-
@nixCraft I weep every time I see one of these types of installations. Novice users are often ill equipped to understand the risks entailed and seeing extremely popular projects using this just method tells the novice, "this is totally normal to be asked to paste a mysterious command into my terminal”.
@moelassus @nixCraft
Novice users are too novice to weep 🫣 -
@nixCraft the first time I saw some of those instructions, I thought it was the hack way of doing it without a package manager. Then I realized it was THE way and was completely shocked.
@thatdnaguy @nixCraft
But isn't it convenient in one's CI pipeline? Inside of some container.
.... looking for dictionary definition of supply chain attack... -
@nixCraft wouldn't it be even better to explain clearly instead of making fun of people?
@levrden @nixCraft
Jo. These folks have been talking soooo many times about it. This is their professional, slightly nervous fun.
On practical note, they really don't know how else to pass this ... trivial info, for practical end.
As a member of normal group, may be you can volunteer persvasive words.
Persvaisive for your locale at least. -
@nixCraft cargo install is just as bad
@Chris1776 @nixCraft
Does it check signatures ... at least -
Visit Homebrew, Rustup, Oh My Zsh, nvm and few other popular open source projects website and you realise that quietly `curl -fsSL` has become the most popular package manager for Linux and Unix users
How did we get here ? 
Just pipe the random commands into your shell with sudo added to the mix. What could possibly go wrong? 
@nixCraft It’s as safe as using npm…
-
Visit Homebrew, Rustup, Oh My Zsh, nvm and few other popular open source projects website and you realise that quietly `curl -fsSL` has become the most popular package manager for Linux and Unix users
How did we get here ? Just pipe the random commands into your shell with sudo added to the mix. What could possibly go wrong? -
Visit Homebrew, Rustup, Oh My Zsh, nvm and few other popular open source projects website and you realise that quietly `curl -fsSL` has become the most popular package manager for Linux and Unix users
How did we get here ? Just pipe the random commands into your shell with sudo added to the mix. What could possibly go wrong? Their trying to say, or just saying what's up to NixCraft. Can't really just say anything on a page, others sees them comments. But I guess there's issue unmentioned, not just what's up all the time.
-
@nixCraft wouldn't it be even better to explain clearly instead of making fun of people?
@levrden
you go to the furniture shop to buy a sofa. the sales assistant tells you that the recommended way to install the sofa in your home is if you make a copy of your door key and give that to her.
️
everyone does this, and soon you've given out a dozen copies of your front door key to everyone including the pizza delivery driver. one morning you wake up your socks and your credit card are missing. 🧦
yes, no one should make fun the victim of such theft. but isn't it okay to mock the businesses who put their customers at risk by asking all of them for their door keys?
@nixCraft -
@levrden
you go to the furniture shop to buy a sofa. the sales assistant tells you that the recommended way to install the sofa in your home is if you make a copy of your door key and give that to her.️everyone does this, and soon you've given out a dozen copies of your front door key to everyone including the pizza delivery driver. one morning you wake up your socks and your credit card are missing. 🧦
yes, no one should make fun the victim of such theft. but isn't it okay to mock the businesses who put their customers at risk by asking all of them for their door keys?
@nixCraft -
@levrden
you go to the furniture shop to buy a sofa. the sales assistant tells you that the recommended way to install the sofa in your home is if you make a copy of your door key and give that to her.️everyone does this, and soon you've given out a dozen copies of your front door key to everyone including the pizza delivery driver. one morning you wake up your socks and your credit card are missing. 🧦
yes, no one should make fun the victim of such theft. but isn't it okay to mock the businesses who put their customers at risk by asking all of them for their door keys?
@nixCraft -
