5 ms·

This is true of anything that ever renders to your terminal. I'm not sure this class of issue is worth worrying about, generally. Sure, these are neat and scary

This is true of anything that ever renders to your terminal. I'm not sure this class of issue is worth worrying about, generally. Sure, these are neat and scary examples. Have you seen some of the recent GPU driver ACEs? Better not render any graphics! A generalization of this is "receiving information from third parties can lead to security issues" which is of course true. Untrusted inputs are always untrusted. Piping curl into bash is one thing, but this is on the level of "are you sure you want to open this file downloaded off the internet?" prompts of yore -- it's not productive.

spoils19 4y ago
> Better not render any graphics! Unironically a good idea. Graphics have always been a mistake - most engineers would agree that if we stuck with very basic output, our software would be in a much better place than today (and more usable, too!)
- mmcnl 4y ago
  Engineers are not UX designers, so their opinion on UX has little value imo.
  - sunjester 4y ago
    Engineers can't be users?
    - rolph 4y ago
      once you become an engineer you cant unsee it very easily, your user vision is now tainted by a higher understanding of problems, rather than feeling frustrated at {FOO = FAIL} bugs and submitting a complaint comment.
    - mmcnl 4y ago
      Sure, but their opinion isn't more valuable just because they happen to be engineers as well.
- bil7 4y ago
  source on most engineers?
- turmeric_root 4y ago
  I don't understand this, how would you create a program to help explore (for example) a 2D coordinate space without any visual aids?
  - quickthrower2 4y ago
    Jameson street: (10,220)->(4,110) Queens lane: (10,220)->(1,55) ... ... You are at: (15,220) Turn left at the next intersection.
  - brewdad 4y ago
    West of House You are standing in an open field west of a white house, with a boarded front door. There is a small mailbox here.
  - spoils19 4y ago
    It may be worth evaluating why we need to explore this space through computing in the first place? Pen and paper have never failed us before, nor has actually traveling to the space in question.
    - turmeric_root 4y ago
      generally speaking, computers are faster at performing calculations than humans. this can be beneficial for humans, as if they are able to convert a problem (for example, mapping the densities of functions over a 2D space) into a purely mathematical one, humans are able to save significant time and effort.
- Bancakes 4y ago
  How about we don't revert 40 years of progress in the name of security theater and frugality
- behnamoh 4y ago
  i both agree and disagree with this. on one hand, it’s true that having everything run in CLI mode would probably make programs truly cross platform. for example, recently I had to use namebenchmark to find the best DNS for my needs. on the M1 mac, the program cannot be run since it’s 32 bit. but i managed to simply run it in a terminal instead by calling its python script (used version 2.7). now i get to run this app on any platform since python is also cross platform. but the GUI version would not be easily ported to linux, windows, etc. on the other hand, most users are not like me. they want something they can interact with using a mouse, and they often use keyboard only to enter words, not commands or shortcuts. so GUI has definitely a place in today’s world.
treve 4y ago
Completely agree, but also I remember that 'piping curl into bash' was always one of the biggest no-no's. I held onto this for so long, but then realized every time I run 'npm i' arbitrary commands can also run, and now it seems wild that I ever cared about curl | bash on websites that I trust
- ziml77 4y ago
  Coming from a Windows world, I've never worried about the `curl | bash` thing. If I would trust an opaque Windows executable from a site, why would I not trust an equally opaque `curl | bash`? I've even seen people concerned about installing Homebrew that way. It is probably one of the most confusing concerns regarding `curl | bash` given that the it's a package manager designed to run arbitrary Ruby code and is often pulling down precompiled applications.
  - kX4A8o4mVmX8aW 4y ago
    Windows executables can be signed, and Homebrew formulae are theoretically reviewed and check a hash when they download binaries. With curl | bash, maybe the download fails partway through, or a hacker has replaced the executable on the server or the URL in the copy/paste instructions with a homograph spoof, or the site serves malware when it detects a curl agent.
- gnubison 4y ago
  Part of the reason is that your connection could be interrupted … and then now what? Hope you like sifting through the script’s entirety and manually checking how much it’s done so far.
  - chii 4y ago
    i'd imagine the download would have to finish first, before the piping into bash finishes and then bash interprets the finished script. I find it hard to believe you could interpret a partial script on the fly as more comes in via stdin.

spoils19 4y ago

> Better not render any graphics! Unironically a good idea. Graphics have always been a mistake - most engineers would agree that if we stuck with very basic output, our software would be in a much better place than today (and more usable, too!)

mmcnl 4y ago
Engineers are not UX designers, so their opinion on UX has little value imo.
- sunjester 4y ago
  Engineers can't be users?
  - rolph 4y ago
    once you become an engineer you cant unsee it very easily, your user vision is now tainted by a higher understanding of problems, rather than feeling frustrated at {FOO = FAIL} bugs and submitting a complaint comment.
  - mmcnl 4y ago
    Sure, but their opinion isn't more valuable just because they happen to be engineers as well.
bil7 4y ago
source on most engineers?
turmeric_root 4y ago
I don't understand this, how would you create a program to help explore (for example) a 2D coordinate space without any visual aids?
- quickthrower2 4y ago
  Jameson street: (10,220)->(4,110) Queens lane: (10,220)->(1,55) ... ... You are at: (15,220) Turn left at the next intersection.
- brewdad 4y ago
  West of House You are standing in an open field west of a white house, with a boarded front door. There is a small mailbox here.
- spoils19 4y ago
  It may be worth evaluating why we need to explore this space through computing in the first place? Pen and paper have never failed us before, nor has actually traveling to the space in question.
  - turmeric_root 4y ago
    generally speaking, computers are faster at performing calculations than humans. this can be beneficial for humans, as if they are able to convert a problem (for example, mapping the densities of functions over a 2D space) into a purely mathematical one, humans are able to save significant time and effort.
Bancakes 4y ago
How about we don't revert 40 years of progress in the name of security theater and frugality
behnamoh 4y ago
i both agree and disagree with this. on one hand, it’s true that having everything run in CLI mode would probably make programs truly cross platform. for example, recently I had to use namebenchmark to find the best DNS for my needs. on the M1 mac, the program cannot be run since it’s 32 bit. but i managed to simply run it in a terminal instead by calling its python script (used version 2.7). now i get to run this app on any platform since python is also cross platform. but the GUI version would not be easily ported to linux, windows, etc. on the other hand, most users are not like me. they want something they can interact with using a mouse, and they often use keyboard only to enter words, not commands or shortcuts. so GUI has definitely a place in today’s world.

treve 4y ago

Completely agree, but also I remember that 'piping curl into bash' was always one of the biggest no-no's. I held onto this for so long, but then realized every time I run 'npm i' arbitrary commands can also run, and now it seems wild that I ever cared about curl | bash on websites that I trust

ziml77 4y ago
Coming from a Windows world, I've never worried about the `curl | bash` thing. If I would trust an opaque Windows executable from a site, why would I not trust an equally opaque `curl | bash`? I've even seen people concerned about installing Homebrew that way. It is probably one of the most confusing concerns regarding `curl | bash` given that the it's a package manager designed to run arbitrary Ruby code and is often pulling down precompiled applications.
- kX4A8o4mVmX8aW 4y ago
  Windows executables can be signed, and Homebrew formulae are theoretically reviewed and check a hash when they download binaries. With curl | bash, maybe the download fails partway through, or a hacker has replaced the executable on the server or the URL in the copy/paste instructions with a homograph spoof, or the site serves malware when it detects a curl agent.
gnubison 4y ago
Part of the reason is that your connection could be interrupted … and then now what? Hope you like sifting through the script’s entirety and manually checking how much it’s done so far.
- chii 4y ago
  i'd imagine the download would have to finish first, before the piping into bash finishes and then bash interprets the finished script. I find it hard to believe you could interpret a partial script on the fly as more comes in via stdin.