7 ms·

Running something is as easy as hijacking one of those “copy and paste this line into your command prompt to install this package” things you see on many open s

Running something is as easy as hijacking one of those “copy and paste this line into your command prompt to install this package” things you see on many open source sites. The command always curls some bigger script down and executes it. Often times it even has you sudo to root. While it would be prudent to examine the script rather than just blindly execute it... I imagine most don’t (myself included).

marcodiego 6y ago
3 features browsers should not have: - access clipboard - mess with scrolling - overlapping controls.
acdha 6y ago
Also you have to do that every time you run it (or pin hashes) — the codecov uploader was fine for a long time before that changed.
habibur 6y ago
Which doesn't sound worse than installing non-app-store applications on any other platform, my take.
- salawat 6y ago
  You say that like doing so is a negative thing. How do you think executable code gets on a system in the first place? Either an Admin builds from source, an Admin installs a binary from a source they deem trustworthy, or you YOLO, download something sketchy to an older system and watch what your Network Analyzer/reverse engineering stack spits out. App stores changed none of that in terms of fundamental activity one needs to do. They just lull users into a false sense of security because "someone else did it". I've run into too many devs who salivated over the idea of embedding cryptominers in game clones to believe it isn't done on a semi-regular basis.
  - musingsole 6y ago
    > I've run into too many devs who salivated over the idea of embedding cryptominers in game clones to believe it isn't done on a semi-regular basis. Reminds me of early days in my career when my mentor and I were discussing user issues with a library we maintained. I didn't realize it at the time, but he was messing with me by suggesting we add some hooks to report usage statistics back to us and use that to improve things. I was young and naive so excuse that I got really excited at the genius of the idea. If not for his wry smile, I would have happily run off and implemented just that.
    - salawat 6y ago
      It's telling that you got grayed out that fast for what I don't think is an uncommon programming life lesson to try to instill. What people run on their machine is no one's business but theirs. Undisclosed/non-consensual information leakage is unethical, and immoral. Period. I'm also not entirely on the status-quo of "accept the EULA or F off" form of disclosure or consent facilitation either. If someone reaches out, by all means, get the detailed info you need, but don't pull it. Let them push it. Other folk's machines don't become yours by virtue of executing some version of a computation you wrote once, no matter how badly Microsoft, IBM, Intel, and the FAANG's wish that were the case. Note, this would be considered anti-thetical to most corporate or for-profit interests in the computing space; so don't be surprised if you get blowback or static for it.
  - dijit 6y ago
    “Trust” is something you can give, though, as long as it’s not to the whole world. Do you trust the Debian project? I mean, there’s reasons to trust them but if you don’t, then don’t run Debian. If you do: the package repositories carry their chain of trust, since they’re signed by Debian maintainers- not the application developers themselves. That’s a large distinction. App stores didn’t give us trust; they have developers direct access to users and, crucially, the ability to charge for software- which was not a consideration for package managers before. And Apple for the most part has been trying to carry the “burden” of ensuring trust, at a high cost.
  - acdha 6y ago
amenod 6y ago
Or just copying a command with a hidden `<span>` in the middle, then pasting it into a terminal which allows multiline pastes (which most terminals do).
michaelpb 6y ago
I know I'm not at all the first to say this, but those "curl into sh" installers are just such terrible ideas in general, and typically inconvenient and brittle as well. I hate the idea of any arbitrary, unknown side-effects happening to my system. Providing an archive `.deb`, `.rpm`, etc is at least more convenient and predictable so it can be installed like a normal package by your package manager (although it doesn't truly help in terms of security or side-effects as it can still run scripts, so although ultimately the issue is still running binaries not vetted by your distro's maintainers)
- staticassertion 6y ago
  > I know I'm not at all the first to say this, but those "curl into sh" installers are just such terrible ideas in general, and typically inconvenient and brittle as well. They're fine for security and super convenient. I get why it's so popular - packaging and publishing debs is often going to be a lot more work, and now you're in the world of either maintaining a package repo or having to deal with an official one.
  - f1refly 6y ago
    Actually it's not hard at all. All you need is a half-working build system and tar installed. You just create an additional build target and you're fine.
    - staticassertion 6y ago
      If you maintain the repository yourself now your setup instruction involves adding a custom apt repo, and then the installation. You also now have to handle multiple package managers, etc. A simple bootstrap script is pretty much as easy as it gets.
  - bayindirh 6y ago
    > packaging and publishing debs is often going to be a lot more work Creating a baseline .deb file takes at most 10 minutes if you know what you're doing. To know what you're doing, you need to spend ~2 hours once. It's not rocket science (finding the documentation is tbh). :)

marcodiego 6y ago

3 features browsers should not have: - access clipboard - mess with scrolling - overlapping controls.

acdha 6y ago

Also you have to do that every time you run it (or pin hashes) — the codecov uploader was fine for a long time before that changed.

habibur 6y ago

Which doesn't sound worse than installing non-app-store applications on any other platform, my take.

salawat 6y ago
You say that like doing so is a negative thing. How do you think executable code gets on a system in the first place? Either an Admin builds from source, an Admin installs a binary from a source they deem trustworthy, or you YOLO, download something sketchy to an older system and watch what your Network Analyzer/reverse engineering stack spits out. App stores changed none of that in terms of fundamental activity one needs to do. They just lull users into a false sense of security because "someone else did it". I've run into too many devs who salivated over the idea of embedding cryptominers in game clones to believe it isn't done on a semi-regular basis.
- musingsole 6y ago
  > I've run into too many devs who salivated over the idea of embedding cryptominers in game clones to believe it isn't done on a semi-regular basis. Reminds me of early days in my career when my mentor and I were discussing user issues with a library we maintained. I didn't realize it at the time, but he was messing with me by suggesting we add some hooks to report usage statistics back to us and use that to improve things. I was young and naive so excuse that I got really excited at the genius of the idea. If not for his wry smile, I would have happily run off and implemented just that.
  - salawat 6y ago
    It's telling that you got grayed out that fast for what I don't think is an uncommon programming life lesson to try to instill. What people run on their machine is no one's business but theirs. Undisclosed/non-consensual information leakage is unethical, and immoral. Period. I'm also not entirely on the status-quo of "accept the EULA or F off" form of disclosure or consent facilitation either. If someone reaches out, by all means, get the detailed info you need, but don't pull it. Let them push it. Other folk's machines don't become yours by virtue of executing some version of a computation you wrote once, no matter how badly Microsoft, IBM, Intel, and the FAANG's wish that were the case. Note, this would be considered anti-thetical to most corporate or for-profit interests in the computing space; so don't be surprised if you get blowback or static for it.
- dijit 6y ago
  “Trust” is something you can give, though, as long as it’s not to the whole world. Do you trust the Debian project? I mean, there’s reasons to trust them but if you don’t, then don’t run Debian. If you do: the package repositories carry their chain of trust, since they’re signed by Debian maintainers- not the application developers themselves. That’s a large distinction. App stores didn’t give us trust; they have developers direct access to users and, crucially, the ability to charge for software- which was not a consideration for package managers before. And Apple for the most part has been trying to carry the “burden” of ensuring trust, at a high cost.
- acdha 6y ago

amenod 6y ago

Or just copying a command with a hidden `<span>` in the middle, then pasting it into a terminal which allows multiline pastes (which most terminals do).

michaelpb 6y ago

I know I'm not at all the first to say this, but those "curl into sh" installers are just such terrible ideas in general, and typically inconvenient and brittle as well. I hate the idea of any arbitrary, unknown side-effects happening to my system. Providing an archive `.deb`, `.rpm`, etc is at least more convenient and predictable so it can be installed like a normal package by your package manager (although it doesn't truly help in terms of security or side-effects as it can still run scripts, so although ultimately the issue is still running binaries not vetted by your distro's maintainers)

staticassertion 6y ago
> I know I'm not at all the first to say this, but those "curl into sh" installers are just such terrible ideas in general, and typically inconvenient and brittle as well. They're fine for security and super convenient. I get why it's so popular - packaging and publishing debs is often going to be a lot more work, and now you're in the world of either maintaining a package repo or having to deal with an official one.
- f1refly 6y ago
  Actually it's not hard at all. All you need is a half-working build system and tar installed. You just create an additional build target and you're fine.
  - staticassertion 6y ago
    If you maintain the repository yourself now your setup instruction involves adding a custom apt repo, and then the installation. You also now have to handle multiple package managers, etc. A simple bootstrap script is pretty much as easy as it gets.
- bayindirh 6y ago
  > packaging and publishing debs is often going to be a lot more work Creating a baseline .deb file takes at most 10 minutes if you know what you're doing. To know what you're doing, you need to spend ~2 hours once. It's not rocket science (finding the documentation is tbh). :)