6 ms·

What amuses me is that the people who are vehemently against using a bash script are often the same people who will run $ ./configure $ make without a

What amuses me is that the people who are vehemently against using a bash script are often the same people who will run $ ./configure $ make without a second thought.

merb 11y ago
Actually 99% of the Time this will install it to /usr/local
- fjarlq 11y ago
  I disagree. Many (probably most) makefiles conform to the GNU Coding Standards, which recommend declaring "all" to be the default make target. `make all` does not install; that's what `make install` is for. https://www.gnu.org/prep/standards/html_node/Standard-Targets.html https://www.gnu.org/prep/standards/html_node/Standard-Target...
  - coldtea 11y ago
    The idea of the original parent comment on Make is not about well conforming makefiles. The idea is that if one doesn't trust a random curl-ed install file, they shouldn't trust a downloaded makefile either -- and for the same reasons, yet tons of people complaint about the first, but have been using the latter for decades without complain...
- coldtea 11y ago
  The idea is that the Makefile (and maybe configure?) could just as well as a "curled" install script contain ANY command, even "sudo rm -rf /". It's not about where it will install it if it works fine.
koolba 11y ago
Don't forget the most important part: sudo make install
pif 11y ago
Yes, but not as root!
- crdoconnor 11y ago
  https://xkcd.com/1200/ https://xkcd.com/1200/
  - nerdponx 11y ago
    But that means they have to steal the laptop in the two minute window before it goes to sleep. It's not like your user password is 1234, right?
    - Zeeem 11y ago
      When I got my last computer, I just copied my home directory over. Funnily enough, my old login sessions worked.
  - the8472 11y ago
    we can get better compartmentalization than that with things like user namespaces (firejail[1]) or spawning a temporary user id[2] [1] https://l3net.wordpress.com/projects/firejail/ https://l3net.wordpress.com/projects/firejail/ [2] https://github.com/teran-mckinney/raru https://github.com/teran-mckinney/raru
rmc 11y ago
If you use checkinstall(1) it'll see what `sudo make install` would do, and create a local package that would do that (e.g. a deb on ubuntu). This package can then be installed in the usual manner, which gives you uninstallability, transactionality, and ensures you don't overwrite any other files installed via a package. This is much better than curl|bash.
- Sean1708 11y ago
  Correct me if I'm wrong but can't you also run arbitrary code while installing packages? Either way I'm not saying `curl | bash` is good, I'm just trying to point out that people have a very knee jerk reaction to it and pay no mind to things which are similarly as dangerous.
  - rmc 11y ago
    Yes, it runs arbitrary code. But checkinstall avoids other downsides from curl|bash

What amuses me is that the people who are vehemently against using a bash script are often the same people who will run $ ./configure $ make without a second thought.

merb 11y ago

Actually 99% of the Time this will install it to /usr/local

fjarlq 11y ago
I disagree. Many (probably most) makefiles conform to the GNU Coding Standards, which recommend declaring "all" to be the default make target. `make all` does not install; that's what `make install` is for. https://www.gnu.org/prep/standards/html_node/Standard-Targets.html https://www.gnu.org/prep/standards/html_node/Standard-Target...
- coldtea 11y ago
  The idea of the original parent comment on Make is not about well conforming makefiles. The idea is that if one doesn't trust a random curl-ed install file, they shouldn't trust a downloaded makefile either -- and for the same reasons, yet tons of people complaint about the first, but have been using the latter for decades without complain...
coldtea 11y ago
The idea is that the Makefile (and maybe configure?) could just as well as a "curled" install script contain ANY command, even "sudo rm -rf /". It's not about where it will install it if it works fine.

koolba 11y ago

Don't forget the most important part: sudo make install

pif 11y ago

Yes, but not as root!

crdoconnor 11y ago
https://xkcd.com/1200/ https://xkcd.com/1200/
- nerdponx 11y ago
  But that means they have to steal the laptop in the two minute window before it goes to sleep. It's not like your user password is 1234, right?
  - Zeeem 11y ago
    When I got my last computer, I just copied my home directory over. Funnily enough, my old login sessions worked.
- the8472 11y ago
  we can get better compartmentalization than that with things like user namespaces (firejail[1]) or spawning a temporary user id[2] [1] https://l3net.wordpress.com/projects/firejail/ https://l3net.wordpress.com/projects/firejail/ [2] https://github.com/teran-mckinney/raru https://github.com/teran-mckinney/raru

rmc 11y ago

If you use checkinstall(1) it'll see what `sudo make install` would do, and create a local package that would do that (e.g. a deb on ubuntu). This package can then be installed in the usual manner, which gives you uninstallability, transactionality, and ensures you don't overwrite any other files installed via a package. This is much better than curl|bash.

Sean1708 11y ago
Correct me if I'm wrong but can't you also run arbitrary code while installing packages? Either way I'm not saying `curl | bash` is good, I'm just trying to point out that people have a very knee jerk reaction to it and pay no mind to things which are similarly as dangerous.
- rmc 11y ago
  Yes, it runs arbitrary code. But checkinstall avoids other downsides from curl|bash