4 ms·

They do at least call it out in the writeup as being poor form. But they don't explain why or offer any alternative...

ziftface 8y ago
They do have an official docker image, that's a pretty good alternative in my opinion.
steevdave 8y ago
Maybe they added it after you read it, but when I read the post they specifically mention it's bad and provide a link to read more on why it's bad. Sure an alternative would be great but the point of the article is to get up and running with the pi-hole software so they went with the fastest install.
WaLLy3K 8y ago
What we need is for the blog to explain things as nicely as the GitHub repo does - unfortunately, it's a topic that's a bit hard to concisely explain in one line. Repo explanation: https://github.com/pi-hole/pi-hole#one-step-automated-install https://github.com/pi-hole/pi-hole#one-step-automated-instal...
pbhjpbhj 8y ago
If by they you mean the pi-hole website then I recall being told I could download it and run the download if I didn't want to pipe curl to bash.
- ziftface 8y ago
  I mean really how is that different from downloading .exe installers and running them?
  - Karunamon 8y ago
    The more realistic fear is what happens if your connection goes away mid-download. While a partial binary won't run, a partial shell script will, and it might just do something bad to your system if you're unlucky.[1] That said, the chances of your connection crapping out in the second or two it takes to download the average sub-couple-kilobyte shell script is minuscule. The fear is seriously overblown. [1]: https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html
    - bigiain 8y ago
      I reckon the biggest problem is normalising the pattern. Piping (https) curl to shell from a site who you were going to trust and download software/run from if they had an alternative method anyway - is no less secure than downloading a tarball or .dmg from the same site. Getting into the habit of piping curl to shell is a bad idea though. It's gonna be easier when you're in a rush to not notice you're copy-pasting "curl -sSL https://install.pi-hole.ru https://install.pi-hole.ru | bash" from some "helpful" forum post...

They do have an official docker image, that's a pretty good alternative in my opinion.

Maybe they added it after you read it, but when I read the post they specifically mention it's bad and provide a link to read more on why it's bad. Sure an alternative would be great but the point of the article is to get up and running with the pi-hole software so they went with the fastest install.

WaLLy3K 8y ago

What we need is for the blog to explain things as nicely as the GitHub repo does - unfortunately, it's a topic that's a bit hard to concisely explain in one line. Repo explanation: https://github.com/pi-hole/pi-hole#one-step-automated-install https://github.com/pi-hole/pi-hole#one-step-automated-instal...

pbhjpbhj 8y ago

If by they you mean the pi-hole website then I recall being told I could download it and run the download if I didn't want to pipe curl to bash.

ziftface 8y ago
I mean really how is that different from downloading .exe installers and running them?
- Karunamon 8y ago
  The more realistic fear is what happens if your connection goes away mid-download. While a partial binary won't run, a partial shell script will, and it might just do something bad to your system if you're unlucky.[1] That said, the chances of your connection crapping out in the second or two it takes to download the average sub-couple-kilobyte shell script is minuscule. The fear is seriously overblown. [1]: https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html
  - bigiain 8y ago
    I reckon the biggest problem is normalising the pattern. Piping (https) curl to shell from a site who you were going to trust and download software/run from if they had an alternative method anyway - is no less secure than downloading a tarball or .dmg from the same site. Getting into the habit of piping curl to shell is a bad idea though. It's gonna be easier when you're in a rush to not notice you're copy-pasting "curl -sSL https://install.pi-hole.ru https://install.pi-hole.ru | bash" from some "helpful" forum post...