5 ms·

Please, don't: "Install the newest version using your package manager or with this command: (wget -O - pi.dk/3 || curl pi.dk/3/ || fetch -o - http://pi.dk/3

by janoc 10y ago

Please, don't: "Install the newest version using your package manager or with this command: (wget -O - pi.dk/3 || curl pi.dk/3/ || fetch -o - http://pi.dk/3) | bash " facepalm

dahart 10y ago
I think this discussion has already gone the rounds on HN multiple times, and it usually gets pointed out that running any installer at all has more or less the same risks as pipe something from the internet straight to the shell -- while this looks scary, it's actually no less safe than how we install any other software. I agree it doesn't look ideal and may not be best practice, but what do you feel is a better realistic alternative? What is the main issue for you? Is it the lack of a hash or checksum to verify what you downloaded, and make sure you didn't get a malicious site or a compromised package?
- heinrich5991 10y ago
  This is HTTP though, not HTTPS. You're not just trusting the authors, but also trusting the network.
  - dahart 10y ago
    Yes, absolutely! So package validation is the issue for you. But how certain are you about everything else you install using HTTPS? (I'm honestly asking, not being rhetorical.) And what is stopping anything else you install from downloading something over HTTP, and executing it?
    - deleted 10y ago
      [deleted]
- gravypod 10y ago
  Who is pi.dk? This isn't using https? If you have a package manager--that has developer signatures for every release and has been checked by multiple others in the community--when even recommend using this? This is far less secure then running apt-get, yum, or even pacman.
- IgorPartola 10y ago
  It's downloaded over HTTP.
- vurpo 10y ago
  The download is not over HTTPS, so you also have to trust the network. Also, the package you're downloading is not signed (which it would be if it came from a software repository, which almost all major operating systems have) so you have to trust whoever runs that website.
IgorPartola 10y ago
You should probably free up some space on your system first: sudo rm -rf /

by janoc 10y ago

Please, don't: "Install the newest version using your package manager or with this command: (wget -O - pi.dk/3 || curl pi.dk/3/ || fetch -o - http://pi.dk/3) | bash " facepalm

dahart 10y ago

I think this discussion has already gone the rounds on HN multiple times, and it usually gets pointed out that running any installer at all has more or less the same risks as pipe something from the internet straight to the shell -- while this looks scary, it's actually no less safe than how we install any other software. I agree it doesn't look ideal and may not be best practice, but what do you feel is a better realistic alternative? What is the main issue for you? Is it the lack of a hash or checksum to verify what you downloaded, and make sure you didn't get a malicious site or a compromised package?

heinrich5991 10y ago
This is HTTP though, not HTTPS. You're not just trusting the authors, but also trusting the network.
- dahart 10y ago
  Yes, absolutely! So package validation is the issue for you. But how certain are you about everything else you install using HTTPS? (I'm honestly asking, not being rhetorical.) And what is stopping anything else you install from downloading something over HTTP, and executing it?
  - deleted 10y ago
    [deleted]
gravypod 10y ago
Who is pi.dk? This isn't using https? If you have a package manager--that has developer signatures for every release and has been checked by multiple others in the community--when even recommend using this? This is far less secure then running apt-get, yum, or even pacman.
IgorPartola 10y ago
It's downloaded over HTTP.
vurpo 10y ago
The download is not over HTTPS, so you also have to trust the network. Also, the package you're downloading is not signed (which it would be if it came from a software repository, which almost all major operating systems have) so you have to trust whoever runs that website.

IgorPartola 10y ago

You should probably free up some space on your system first: sudo rm -rf /