4 ms·

What value does this provide? It looks like nothing more than a security vulnerability with a new non-standard and crippled interface. Tar is available on all t

What value does this provide? It looks like nothing more than a security vulnerability with a new non-standard and crippled interface. Tar is available on all the target platforms, for example.

jakobdabo 11y ago
It's the Windows way: download this setup program and execute it to install on your computer.
duggan 11y ago
In a pithy one liner: it's curl pipe bash for local binaries. I've run into it when I used to install Virtualbox "Guest Additions" or whenever I'd make the questionable decision to use the latest video drivers during my annual dalliance with desktop Linux a decade ago. The value it provides is fewer steps in an installation guide for non-power users (or as jakobdabo mentions below, particularly for users coming from the Windows "double click to install" world). It would extract and run a post extract hook. I haven't come across it much in the last few years though.
kazinator 11y ago
Self-extraction isn't any sort of additional security vulnerability if what you're using it for is to install a program that you're going to be executing. (For installing non-executable material, it does elevate the risk.)
- jedbrown 11y ago
  Even for an executable, the installation environment may be different from the execution environment (which may be sandboxed, mounted read-only, etc.). Moreover, a tarball gives you a reliable manifest so that you know what will happen before installing. A shell script just does whatever it wants, making it potentially surprising/destructive and difficult to clean up.
  - kazinator 11y ago
    True. "Run foo.run thing as root, so it can put stuff in /usr/bin, then switch to your regular account to use it". Oops! The thing is, that ship has largely sailed, with the proliferation of package management that prompts you for a password to go sudo. sudo apt-get install whatever # trust your distro sudo ./foo.run # trust foo.run's publisher, a bit worse > * A shell script just does whatever it wants, making it potentially surprising/destructive and difficult to clean up.* Just like Windows installers---which is why we need utilities like Revo Uninstaller. This lets us run the application's uninstaller first, then scan the entire filesystem and registry for what looks like bits and pieces that might belong to that program, and let the user select which of them to blow off. I use it quite a bit.
stestagg 11y ago
It's actually a reasonable app deployment mechanism for systems where you only have regular-user access. You can bundle up a compiled app, dependencies, and settings, and have a single, repeatable, easy to deploy build. if the system has a tmpfs/ramdisk mount, it can also extract itself there, and have a no HDD deployment, which can dramatically speed things up too.

What value does this provide? It looks like nothing more than a security vulnerability with a new non-standard and crippled interface. Tar is available on all the target platforms, for example.

jakobdabo 11y ago

It's the Windows way: download this setup program and execute it to install on your computer.

duggan 11y ago

In a pithy one liner: it's curl pipe bash for local binaries. I've run into it when I used to install Virtualbox "Guest Additions" or whenever I'd make the questionable decision to use the latest video drivers during my annual dalliance with desktop Linux a decade ago. The value it provides is fewer steps in an installation guide for non-power users (or as jakobdabo mentions below, particularly for users coming from the Windows "double click to install" world). It would extract and run a post extract hook. I haven't come across it much in the last few years though.

kazinator 11y ago

Self-extraction isn't any sort of additional security vulnerability if what you're using it for is to install a program that you're going to be executing. (For installing non-executable material, it does elevate the risk.)

jedbrown 11y ago
Even for an executable, the installation environment may be different from the execution environment (which may be sandboxed, mounted read-only, etc.). Moreover, a tarball gives you a reliable manifest so that you know what will happen before installing. A shell script just does whatever it wants, making it potentially surprising/destructive and difficult to clean up.
- kazinator 11y ago
  True. "Run foo.run thing as root, so it can put stuff in /usr/bin, then switch to your regular account to use it". Oops! The thing is, that ship has largely sailed, with the proliferation of package management that prompts you for a password to go sudo. sudo apt-get install whatever # trust your distro sudo ./foo.run # trust foo.run's publisher, a bit worse > * A shell script just does whatever it wants, making it potentially surprising/destructive and difficult to clean up.* Just like Windows installers---which is why we need utilities like Revo Uninstaller. This lets us run the application's uninstaller first, then scan the entire filesystem and registry for what looks like bits and pieces that might belong to that program, and let the user select which of them to blow off. I use it quite a bit.

stestagg 11y ago

It's actually a reasonable app deployment mechanism for systems where you only have regular-user access. You can bundle up a compiled app, dependencies, and settings, and have a single, repeatable, easy to deploy build. if the system has a tmpfs/ramdisk mount, it can also extract itself there, and have a no HDD deployment, which can dramatically speed things up too.