5 ms·

> curl -s https://raw.github.com/xdissent/ievms/master/ievms.sh https://raw.github.com/xdissent/ievms/master/ievms.sh | bash Bad trend in the open-source commu

> curl -s https://raw.github.com/xdissent/ievms/master/ievms.sh https://raw.github.com/xdissent/ievms/master/ievms.sh | bash Bad trend in the open-source community. Please don't ask your users to install stuff this way. Not that you can't be trusted, it leads to people dropping their guard.

bretthopper 15y ago
This comes up every time an install script like that is used, and in a lot of cases, it's a warrantless criticism. Projects like this are obviously targeted towards developers as they're hosted on github. If you really want to check out what the script is doing, just look at the file. Or better yet, clone the repo and use it/install however you want.
xdissent 15y ago
I understand your point and I'm open to suggestions on how to assuage any security concerns while maintaining convenience. I don't know if users are more likely to read and understand the source if it's provided only as a separate download, however. Perhaps just a big honkin warning in the README?
chc 15y ago
Is it particularly worse than downloading and blindly running the code in separate steps? I don't think the majority of users have ever extensively audited the software they run, so it's not exactly a new trend. If you are capable of evaluating this script, you already know how to do it.
- trafficlight 15y ago
  I would bet a fair amount would open the script up in an editor and say, "Yep. That's code alright".
michaelbuckbee 15y ago
I kind of view bash piping as the worlds easiest install package. Unequivocally, it is dangerous to run random pieces of code from the internet, it just seems odd to me that if this same code was in a nice packaged install wizard nobody would say anything about it.
- wahnfrieden 15y ago
  Maybe it should include a first step of piping it to less for review, followed by piping to bash if it looks fine. Slightly better...
  - Groxx 15y ago
    At which point the people who know how to read it will do so (I did, out of curiosity) because it's so easy, and the people who don't will get jargonjargon [*&*@![]2\3 if [[jargon -f "words!"]] jargon # jargon jargon jargon /&$_)(82 fi # jargon the jargon jar(){ gon # yay pictures! # ∑´∞§∞¶•ø¨ˆ∆£˜¡–ª¢ø•ª¶π™˜£º¥µ # <(^.^)> # ˚∆∂¥•¡º™ª•¶ƒ˙¨ˆ # # ˙π¡˜ø£•¶√≠˚•™µº–£¨≤ # <= ˚∆˚! but it works # } and just go to the next step.
    - joshu 15y ago
      Did you just come up with that? Hilarious
Groxx 15y ago
Why is it worse than running an installer? It has identical capabilities, but the .sh file can be read.
- mtogo 15y ago
  If you install a package via the package managers on debian, ubuntu, fedora, and other major distros you can be reasonably sure that the packages aren't malicious because they've been security reviewed before they made it into APT/YUM/etc. Downloading some shell script off the internet and running it without even reading it first is a really bad idea by comparison.
  - Groxx 15y ago
    So, you mean like everything on OSX and Windows, where you don't have such package management systems with (long-standing, trustable) benevolent hosts? Yeah, downloading some application off the internet and running them is a really bad idea - how is this worse? edit: how about iOS? There have been news entries about them sending data where they shouldn't - that's a curated host. iOS is a lot more sandboxed, but that doesn't make the danger nonexistent.
    - deleted 15y ago
      [deleted]
      - bretthoerner 15y ago
        I take it you don't use pip, gem, sbt, (insert your favorite language's package manager) either? If you do, what's the difference?
  - irahul 15y ago
    > If you install a package via the package managers on debian, ubuntu, fedora, and other major distros you can be reasonably sure that the packages aren't malicious because they've been security reviewed before they made it into APT/YUM/etc When people are delivering software that isn't in the official repository, downloading a script and running it is no less secure than the alternatives.
deleted 15y ago
[deleted]
irahul 15y ago
> Bad trend in the open-source community. Please don't ask your users to install stuff this way. Not that you can't be trusted, it leads to people dropping their guard. And what will be the right way to do it? The way people don't drop their guard? `./configure && make && sudo make install`? Or `sudo apt-get install`? How are any of these or many other options seemingly better than this?
- lloeki 15y ago
  You probably mean 'add-apt-repository foorepo && apt-get update && apt-get install foopkg' or 'dpkg -i foopkg' (as root) because as is, 'apt-get install' is innocuous given one uses the default trusted, signed and whatnot repos.
acdha 15y ago
I'd support this more if they weren't using https - since the user's going to run it anyway, there's no real advantage over any other means of getting this file onto their system. Well-known http:// http:// urls are worse since they allow interesting spoofing attacks if they become popular.

bretthopper 15y ago

This comes up every time an install script like that is used, and in a lot of cases, it's a warrantless criticism. Projects like this are obviously targeted towards developers as they're hosted on github. If you really want to check out what the script is doing, just look at the file. Or better yet, clone the repo and use it/install however you want.

xdissent 15y ago

I understand your point and I'm open to suggestions on how to assuage any security concerns while maintaining convenience. I don't know if users are more likely to read and understand the source if it's provided only as a separate download, however. Perhaps just a big honkin warning in the README?

chc 15y ago

Is it particularly worse than downloading and blindly running the code in separate steps? I don't think the majority of users have ever extensively audited the software they run, so it's not exactly a new trend. If you are capable of evaluating this script, you already know how to do it.

trafficlight 15y ago
I would bet a fair amount would open the script up in an editor and say, "Yep. That's code alright".

michaelbuckbee 15y ago

I kind of view bash piping as the worlds easiest install package. Unequivocally, it is dangerous to run random pieces of code from the internet, it just seems odd to me that if this same code was in a nice packaged install wizard nobody would say anything about it.

wahnfrieden 15y ago
Maybe it should include a first step of piping it to less for review, followed by piping to bash if it looks fine. Slightly better...
- Groxx 15y ago
  At which point the people who know how to read it will do so (I did, out of curiosity) because it's so easy, and the people who don't will get jargonjargon [*&*@![]2\3 if [[jargon -f "words!"]] jargon # jargon jargon jargon /&$_)(82 fi # jargon the jargon jar(){ gon # yay pictures! # ∑´∞§∞¶•ø¨ˆ∆£˜¡–ª¢ø•ª¶π™˜£º¥µ # <(^.^)> # ˚∆∂¥•¡º™ª•¶ƒ˙¨ˆ # # ˙π¡˜ø£•¶√≠˚•™µº–£¨≤ # <= ˚∆˚! but it works # } and just go to the next step.
  - joshu 15y ago
    Did you just come up with that? Hilarious

Groxx 15y ago

Why is it worse than running an installer? It has identical capabilities, but the .sh file can be read.

mtogo 15y ago
If you install a package via the package managers on debian, ubuntu, fedora, and other major distros you can be reasonably sure that the packages aren't malicious because they've been security reviewed before they made it into APT/YUM/etc. Downloading some shell script off the internet and running it without even reading it first is a really bad idea by comparison.
- Groxx 15y ago
  So, you mean like everything on OSX and Windows, where you don't have such package management systems with (long-standing, trustable) benevolent hosts? Yeah, downloading some application off the internet and running them is a really bad idea - how is this worse? edit: how about iOS? There have been news entries about them sending data where they shouldn't - that's a curated host. iOS is a lot more sandboxed, but that doesn't make the danger nonexistent.
  - deleted 15y ago
    [deleted]
    - bretthoerner 15y ago
      I take it you don't use pip, gem, sbt, (insert your favorite language's package manager) either? If you do, what's the difference?
- irahul 15y ago
  > If you install a package via the package managers on debian, ubuntu, fedora, and other major distros you can be reasonably sure that the packages aren't malicious because they've been security reviewed before they made it into APT/YUM/etc When people are delivering software that isn't in the official repository, downloading a script and running it is no less secure than the alternatives.

deleted 15y ago

[deleted]

irahul 15y ago

> Bad trend in the open-source community. Please don't ask your users to install stuff this way. Not that you can't be trusted, it leads to people dropping their guard. And what will be the right way to do it? The way people don't drop their guard? `./configure && make && sudo make install`? Or `sudo apt-get install`? How are any of these or many other options seemingly better than this?

lloeki 15y ago
You probably mean 'add-apt-repository foorepo && apt-get update && apt-get install foopkg' or 'dpkg -i foopkg' (as root) because as is, 'apt-get install' is innocuous given one uses the default trusted, signed and whatnot repos.

acdha 15y ago

I'd support this more if they weren't using https - since the user's going to run it anyway, there's no real advantage over any other means of getting this file onto their system. Well-known http:// http:// urls are worse since they allow interesting spoofing attacks if they become popular.