4 ms·

$ curl -L https://bit.ly/glances | /bin/bash That (curl|bash) is really shady. Not saying the software is malicious, but if you're going to install it I would

$ curl -L https://bit.ly/glances | /bin/bash That (curl|bash) is really shady. Not saying the software is malicious, but if you're going to install it I wouldn't do it like that.

nickserv 8y ago
Agreed, especially since there's a pypi package available.
- ams6110 8y ago
  Why is a pypi package better than a bash script? Or is it the URL shortener that concerns you?
  - noja 8y ago
    Because a pypi package can be compared to a source. A piped bash script might change per-client or per-request.
    - placebo 8y ago
      This is the correct way to answer a question. Not sure why the parent question is being downvoted rather than simply being answered. All that does is promote ignorance.
    - lemagedurage 8y ago
      The average person doesn't compare the source, and the average person doesn't read the bash script, for them it's the same thing. For the person who wants to read the source, I'll argue that pressing backspace 6 time to delete "| bash" is _more_ straightforward than looking up the source for a PyPi package. There's only a subtle difference between a PyPi account and a server (script hosted on Github?) being pwned. Though yes, I do believe they shouldn't have used an URL shortener.
- e12e 8y ago
  And it's a bit weird to announce it as cross-platform (windows support) and not promote a cross-platform setup/install process. And through a third party url shortener of all things?! There's no guarantee what'll come out the other side of a bit.ly link... At least leverage github directly, rather than add another level of indirection ... Looking at the pointer: https://raw.githubusercontent.com/nicolargo/glancesautoinstall/master/install.sh https://raw.githubusercontent.com/nicolargo/glancesautoinsta... It doesn't even appear to support os x, installs via pip anyway (as root, unconditionally if you happen to have sudo credentials cached, or allow the script to elevate privileges). This is probably never what you want, with the possible exception of a docker image, chroot/jail or similar. And it really makes little sense to hard-depend on bash/sh for a cross-platform python utility - if pip install is too complicated, it shouldn't be too arduous to provide a sane python script for installation, that does most of this song and dance [and default to a virtual env] on all supported platforms. It's not like it can run without python, anyway...
eat_veggies 8y ago
Especially since you can actually detect server-side when its output is being piped to bash. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
merlincorey 8y ago
There are OS packages for `glances` as well as `pip` packages. No one should be installing anything from curl-to-shell pipelines - but sadly, they do.
Proven 8y ago
Doh. Nobody forces you to install it like that

$ curl -L https://bit.ly/glances | /bin/bash That (curl|bash) is really shady. Not saying the software is malicious, but if you're going to install it I wouldn't do it like that.

nickserv 8y ago

Agreed, especially since there's a pypi package available.

ams6110 8y ago
Why is a pypi package better than a bash script? Or is it the URL shortener that concerns you?
- noja 8y ago
  Because a pypi package can be compared to a source. A piped bash script might change per-client or per-request.
  - placebo 8y ago
    This is the correct way to answer a question. Not sure why the parent question is being downvoted rather than simply being answered. All that does is promote ignorance.
  - lemagedurage 8y ago
    The average person doesn't compare the source, and the average person doesn't read the bash script, for them it's the same thing. For the person who wants to read the source, I'll argue that pressing backspace 6 time to delete "| bash" is _more_ straightforward than looking up the source for a PyPi package. There's only a subtle difference between a PyPi account and a server (script hosted on Github?) being pwned. Though yes, I do believe they shouldn't have used an URL shortener.
e12e 8y ago
And it's a bit weird to announce it as cross-platform (windows support) and not promote a cross-platform setup/install process. And through a third party url shortener of all things?! There's no guarantee what'll come out the other side of a bit.ly link... At least leverage github directly, rather than add another level of indirection ... Looking at the pointer: https://raw.githubusercontent.com/nicolargo/glancesautoinstall/master/install.sh https://raw.githubusercontent.com/nicolargo/glancesautoinsta... It doesn't even appear to support os x, installs via pip anyway (as root, unconditionally if you happen to have sudo credentials cached, or allow the script to elevate privileges). This is probably never what you want, with the possible exception of a docker image, chroot/jail or similar. And it really makes little sense to hard-depend on bash/sh for a cross-platform python utility - if pip install is too complicated, it shouldn't be too arduous to provide a sane python script for installation, that does most of this song and dance [and default to a virtual env] on all supported platforms. It's not like it can run without python, anyway...

eat_veggies 8y ago

Especially since you can actually detect server-side when its output is being piped to bash. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

merlincorey 8y ago

There are OS packages for `glances` as well as `pip` packages. No one should be installing anything from curl-to-shell pipelines - but sadly, they do.

Proven 8y ago

Doh. Nobody forces you to install it like that