4 ms·

Beware, that setup.py script is not a setuptools script but builds the other scripts and config on the fly. Install is "wget | sudo python." Then it overclock

Beware, that setup.py script is not a setuptools script but builds the other scripts and config on the fly. Install is "wget | sudo python." Then it overclocks the Pi. :-/ I once tried installing timidity and usb keyboard on a RPi but there was too much latency to be useful. Interested in the subject, but seems this could be done in a safer manner.

suifbwish 4y ago
Never trust anyone who gives you a command that both downloads and executes any script. That person is either malicious, incompetent or they know the risks and just don’t give a shit
- adamomada 4y ago
  It’s just a short-cut, you can easily examine the script and run it later. Most of the time I’ve seen a fair warning to always do the same.
- dmerrick 4y ago
  How is this different from any other installer that asks for admin access? At least the wget method gives you an opportunity to look at the install script, which most software installers dont provide
- _abox 4y ago
  Homebrew for Mac is super popular among developers: https://brew.sh/ https://brew.sh/ And yeah they should know better. On the other hand, modern programming languages also pull libraries from all over the place without any serious vetting. This is becoming more and more of a problem as several people have demonstrated here: https://news.ycombinator.com/item?id=30679098 https://news.ycombinator.com/item?id=30679098 I bet sooner or later this will result in a major wannacry/log4j style international incident and then we'll start doing something about it.
- rosndo 4y ago
  This is a weird take. For example: From a security POV it’s not meaningfully different from being given a download link for a binary.
sitkack 4y ago
It is made by hobbyists to turn a rpi into a dedicated device, I can understand the brute force methods they employ. It looks like it needs the OCd speed to run the software. A different name that didn't collide with current Python ecosystem scripts wouldn't raise as many concerns. *edit, inverted meaning of last sentance
- sitkack 4y ago
  Instead of setup.py, it could be called, local_hardware_install.py or somesuch.

suifbwish 4y ago

Never trust anyone who gives you a command that both downloads and executes any script. That person is either malicious, incompetent or they know the risks and just don’t give a shit

adamomada 4y ago
It’s just a short-cut, you can easily examine the script and run it later. Most of the time I’ve seen a fair warning to always do the same.
dmerrick 4y ago
How is this different from any other installer that asks for admin access? At least the wget method gives you an opportunity to look at the install script, which most software installers dont provide
_abox 4y ago
Homebrew for Mac is super popular among developers: https://brew.sh/ https://brew.sh/ And yeah they should know better. On the other hand, modern programming languages also pull libraries from all over the place without any serious vetting. This is becoming more and more of a problem as several people have demonstrated here: https://news.ycombinator.com/item?id=30679098 https://news.ycombinator.com/item?id=30679098 I bet sooner or later this will result in a major wannacry/log4j style international incident and then we'll start doing something about it.
rosndo 4y ago
This is a weird take. For example: From a security POV it’s not meaningfully different from being given a download link for a binary.

sitkack 4y ago

It is made by hobbyists to turn a rpi into a dedicated device, I can understand the brute force methods they employ. It looks like it needs the OCd speed to run the software. A different name that didn't collide with current Python ecosystem scripts wouldn't raise as many concerns. *edit, inverted meaning of last sentance

sitkack 4y ago
Instead of setup.py, it could be called, local_hardware_install.py or somesuch.