7 ms·

Cool, now I don't need to remember the arcane incantation to download a file with Powershell. Do you think we'll see things like the good old "curl <some url>

Cool, now I don't need to remember the arcane incantation to download a file with Powershell. Do you think we'll see things like the good old "curl <some url> | bash" for Windows now? They still have no package manager worth using.

ygra 9y ago
Hasn't that been popular as iwr <some url> | iex for a while?
pjc50 9y ago
> curl <some url> | bash That's still not a package manager worth using.
temp-dude-87844 9y ago
Windows 10 has a "package manager", of course, that's quite good, but both user culture, developer disinterest, and years and years of inertia keeps it from being used for enough things to cross the network-effect side of some treshold of "worthwhile". The 'download | execute' paradigm, on the other hand, is the complete antithesis of package management, to where your desire to obtain and execute the code trumps your willingness and patience to wait until it has been vetted by your preferred package manager, and installed in a less haphazard way. I fail to see your point.
- sjellis 9y ago
  If you are referring to the package management stuff in PowerShell, that's just a unified interface to several different package management systems, each of which handles specific types of packages. Windows has MSI, VSIX, PowerShell modules and probably some others as well, all of which are separate from Microsoft Update.
Analemma_ 9y ago
Yeah, “iwr” sure was hard to remember.
- nowbacktowork 9y ago
  I'm pretty sure curl is also an alias for iwr.
koshersalt 9y ago
Have you tried chocolatey? I’ve really enjoyed using it
- kafkamind 9y ago
  MSYS2 now comes with pacman! it's great.
Zekio 9y ago
scoop(1) is a pretty cool package manager 1) https://github.com/lukesampson/scoop https://github.com/lukesampson/scoop
Iv 9y ago
> the good old "curl <some url> | bash" I would be thankful if the habit of trusting a random IP with control of one's shell could die, forever.
- 0xFFFE 9y ago
  Precisely. Why would anyone do that is beyond me.
- jjnoakes 9y ago
  Why would you be using a random ip? That incantation is usually used with a URL where you would have just downloaded and installed the software manually anyway. There are various arguments against the curl-piped-to-shell idiom but "random ip" doesn't seem like a valid one.
  - shakna 9y ago
    A URL and an IP are not equal. Building a script that acts differently for a web browser, a normal download, and curl, is trivial, and I've seen it happen. Here's a proof-of-concept[0] someone else wrote. Manually downloading is safer, at least you can review, curling straight into a shell is inherently unsafe. The better option is still a package manager, but curling straight to a shell is very unsafe. [0] https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install-scripts-can-be-dangerous/ https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install...
    - jjnoakes 9y ago
      Why would you be using an IP and not a URL? And why wouldn't you trust the source of the install script as much as any other installer? Do you audit the binary installers you use as well? I don't disagree about a minor difference between the methods, but I definitely disagree with piping to sh being "very unsafe". If you trust the site/author enough to run their code on your computer at all, the install method risk difference is but a tiny drop in the bucket.
      - 9y ago
paulie_a 9y ago
Curl some url and execute is a massive security risk.
- jjnoakes 9y ago
  In what way is it more of a risk over downloading and executing an installer from the same site? The only reason I can think of is if the script partially downloads and only half executes. Doesn't seem "massive" though...
- Spivak 9y ago
  As opposed to download in IE and then double click the executable? At least on Windows that battle has already been lost.
coldacid 9y ago
If you're still using Windows PowerShell proper instead of PowerShell Core, you still need to delete the curl alias or call curl explicitly as curl.exe in order to use it. Also, take a look at Chocolatey for package management. Yeah it's not a built-in thing, but it's pretty decent.
- nerdponx 9y ago
  I hated Chocolatey. Those binary shims seemed to produce slow, unstable binaries. There also still isn't a fully-usable Chocolatey backend for the PowerShell package manager. The Programs & Features pane works just fine for me as a package manager.

ygra 9y ago

Hasn't that been popular as iwr <some url> | iex for a while?

pjc50 9y ago

> curl <some url> | bash That's still not a package manager worth using.

temp-dude-87844 9y ago

Windows 10 has a "package manager", of course, that's quite good, but both user culture, developer disinterest, and years and years of inertia keeps it from being used for enough things to cross the network-effect side of some treshold of "worthwhile". The 'download | execute' paradigm, on the other hand, is the complete antithesis of package management, to where your desire to obtain and execute the code trumps your willingness and patience to wait until it has been vetted by your preferred package manager, and installed in a less haphazard way. I fail to see your point.

sjellis 9y ago
If you are referring to the package management stuff in PowerShell, that's just a unified interface to several different package management systems, each of which handles specific types of packages. Windows has MSI, VSIX, PowerShell modules and probably some others as well, all of which are separate from Microsoft Update.

Analemma_ 9y ago

Yeah, “iwr” sure was hard to remember.

nowbacktowork 9y ago
I'm pretty sure curl is also an alias for iwr.

koshersalt 9y ago

Have you tried chocolatey? I’ve really enjoyed using it

kafkamind 9y ago
MSYS2 now comes with pacman! it's great.

Zekio 9y ago

scoop(1) is a pretty cool package manager 1) https://github.com/lukesampson/scoop https://github.com/lukesampson/scoop

Iv 9y ago

> the good old "curl <some url> | bash" I would be thankful if the habit of trusting a random IP with control of one's shell could die, forever.

0xFFFE 9y ago
Precisely. Why would anyone do that is beyond me.
jjnoakes 9y ago
Why would you be using a random ip? That incantation is usually used with a URL where you would have just downloaded and installed the software manually anyway. There are various arguments against the curl-piped-to-shell idiom but "random ip" doesn't seem like a valid one.
- shakna 9y ago
  A URL and an IP are not equal. Building a script that acts differently for a web browser, a normal download, and curl, is trivial, and I've seen it happen. Here's a proof-of-concept[0] someone else wrote. Manually downloading is safer, at least you can review, curling straight into a shell is inherently unsafe. The better option is still a package manager, but curling straight to a shell is very unsafe. [0] https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install-scripts-can-be-dangerous/ https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install...
  - jjnoakes 9y ago
    Why would you be using an IP and not a URL? And why wouldn't you trust the source of the install script as much as any other installer? Do you audit the binary installers you use as well? I don't disagree about a minor difference between the methods, but I definitely disagree with piping to sh being "very unsafe". If you trust the site/author enough to run their code on your computer at all, the install method risk difference is but a tiny drop in the bucket.
    - 9y ago

paulie_a 9y ago

Curl some url and execute is a massive security risk.

jjnoakes 9y ago
In what way is it more of a risk over downloading and executing an installer from the same site? The only reason I can think of is if the script partially downloads and only half executes. Doesn't seem "massive" though...
Spivak 9y ago
As opposed to download in IE and then double click the executable? At least on Windows that battle has already been lost.

coldacid 9y ago

If you're still using Windows PowerShell proper instead of PowerShell Core, you still need to delete the curl alias or call curl explicitly as curl.exe in order to use it. Also, take a look at Chocolatey for package management. Yeah it's not a built-in thing, but it's pretty decent.

nerdponx 9y ago
I hated Chocolatey. Those binary shims seemed to produce slow, unstable binaries. There also still isn't a fully-usable Chocolatey backend for the PowerShell package manager. The Programs & Features pane works just fine for me as a package manager.