4 ms·

What would be a safer alternative? At some point you'll have to trust volta.sh unless you're willing to audit all of the code manually. One potential issue wit

by simias 5y ago

What would be a safer alternative? At some point you'll have to trust volta.sh unless you're willing to audit all of the code manually. One potential issue with `curl | sh` is that if the connection dies prematurely you may end up executing half a script which can lead to all sorts of issues, but judging by the current version of the script they Did It Right by declaring a bunch of functions and calling their "main" in the last line, ensuring that the script does nothing if not fully loaded.

choeger 5y ago
Safer and more Secure? Ask the users to run cargo install X or whatever the cargo equivalent of pip install is. Even more secure than that? Upload a signed tarball to multiple mirrors and generate the tarball from a public got repo in a reproducible manner. Ideal? Publish to the distro repositories and leverage the process that these guys have in place (I know their audience mostly runs macbooks, but that's a different problem to solve).
- capableweb 5y ago
  > I know their audience mostly runs macbooks, but that's a different problem to solve). I disagree with the assumption "their audience" mostly use Macbooks, but regardless. This sentence from you really describes what you're getting wrong. You assume a audience that they are targeting, and then ignore providing any sort of solution for that audience and even acknowledging that you know there is another problem that does need solving, but you're only interested in providing solutions that fits your idea of the problem. All of those things you've mentions requires an already installed toolchain for managing packages. "curl | bash" is popular because the small footprint and relative ease of making as safe as many other distribution methods. Not to say I also vastly prefer my package manager I use. But I do realize there is world outside of me as well, that have different problems and might require different solutions with different tradeoffs.
  - choeger 5y ago
    First of all, I am pretty certain that the majority of javascript developers runs a MacBook when they have the choice. Second, no I don't think that "I get something wrong". It's not my fault that people use MacOS and don't have a decent package manager (although I hear dood things about homebrew, it's nowhere near rpm/DNF, afaik). It's also not my fault that people that do have a decent package manager don't contribute enough to get tools like volta packaged. Still, I can warn about the stupid idea to execute random she'll scripts from the internet for a "convenient small recipe". Even for that I get flak and attempts to justify the behavior. So no, I don't feel obliged at all to solve their problems. This vector will be exploited some day and it will be embarrassing for some people. Essentially, I think that people are lazy regarding these things and don't want to think about what they are doing with their systems. If I had an idea how to make things comfortable like this and still be safe and secure, I would sell it. But I don't really see a way to solve this except for moving the code to a trusted channel with a dedicated approval process.

by simias 5y ago

choeger 5y ago

Safer and more Secure? Ask the users to run cargo install X or whatever the cargo equivalent of pip install is. Even more secure than that? Upload a signed tarball to multiple mirrors and generate the tarball from a public got repo in a reproducible manner. Ideal? Publish to the distro repositories and leverage the process that these guys have in place (I know their audience mostly runs macbooks, but that's a different problem to solve).

capableweb 5y ago
> I know their audience mostly runs macbooks, but that's a different problem to solve). I disagree with the assumption "their audience" mostly use Macbooks, but regardless. This sentence from you really describes what you're getting wrong. You assume a audience that they are targeting, and then ignore providing any sort of solution for that audience and even acknowledging that you know there is another problem that does need solving, but you're only interested in providing solutions that fits your idea of the problem. All of those things you've mentions requires an already installed toolchain for managing packages. "curl | bash" is popular because the small footprint and relative ease of making as safe as many other distribution methods. Not to say I also vastly prefer my package manager I use. But I do realize there is world outside of me as well, that have different problems and might require different solutions with different tradeoffs.
- choeger 5y ago
  First of all, I am pretty certain that the majority of javascript developers runs a MacBook when they have the choice. Second, no I don't think that "I get something wrong". It's not my fault that people use MacOS and don't have a decent package manager (although I hear dood things about homebrew, it's nowhere near rpm/DNF, afaik). It's also not my fault that people that do have a decent package manager don't contribute enough to get tools like volta packaged. Still, I can warn about the stupid idea to execute random she'll scripts from the internet for a "convenient small recipe". Even for that I get flak and attempts to justify the behavior. So no, I don't feel obliged at all to solve their problems. This vector will be exploited some day and it will be embarrassing for some people. Essentially, I think that people are lazy regarding these things and don't want to think about what they are doing with their systems. If I had an idea how to make things comfortable like this and still be safe and secure, I would sell it. But I don't really see a way to solve this except for moving the code to a trusted channel with a dedicated approval process.