3 ms·

> Why is there still software asking user to run sudo on something downloaded from the internet? Does it do this? From https://github.com/zyedidia/micro#quick

> Why is there still software asking user to run sudo on something downloaded from the internet? Does it do this? From https://github.com/zyedidia/micro#quick-install-script https://github.com/zyedidia/micro#quick-install-script Quick-install script curl https://getmic.ro | bash The script will place the micro binary in the current directory. From there, you can move it to a directory on your path of your choosing (e.g. `sudo mv micro /usr/bin`). It points out you need `sudo` to move the binary to `/usr/bin` - if that's even what you want to do - but... yeah? So?

gabrielgio 3y ago
It says when you run the installer: Note that you must install micro to a directory accessible to all users when doing this, typically /usr/bin. cd to that directory before running this script. E.g.: $ cd /usr/bin $ curl https://getmic.ro/r | sudo sh or $ su - root -c "cd /usr/bin; wget -O- https://getmic.ro | GETMICRO_REGISTER=y sh"
- Karellen 3y ago
  You conveniently missed off the lines of text above that which explain what "doing this" is: getmicro can use update-alternatives to register micro as a system text editor. For example, this will allow `crontab -e` open the cron file with micro. To enable this feature, define the GETMICRO_REGISTER variable or use the URL `https://getmic.ro/r`. Note that you must install micro to a directory accessible to all users when doing this... Yes, if you want to install `micro` as a system text editor, something you can do (but don't have to), you need privs. Again, so?
  - gabrielgio 3y ago
    I know why it is asking for sudo and that was not my point. Again, my point is: you should never ask the user to run sudo from curl (or actually, don't curl to bash at all). There are plenty ways to sploit that. Again, I know it needs root to move the bin to a root owned folder or update the default editor, but, again, you should never ask (or suggest) the user to pipe shit from the internet, it is security risk. Also there is not even reason for it, micro is available in every distro.
codedokode 3y ago
This is just a demonstration of how unfriendly is Linux to supporting third-party software. You are supposed either to use software from distribution's repository or compile it yourself. And if you are a software developer, then you are on your own to decide how to support hundreds of different distributions (the most popular way is to statically compile everything into a single binary). Such scripts remind me of DOS-era "installers", and they are awful: - it is unknown whether your distribution is supported or not - this script is probably not tested on many distributions and can break something - it is unsafe, because you are running a code that some random person posted on the Internet without any sandboxing
- gabrielgio 3y ago
  No, it is not a demonstration of anything. I'm not saying there is no fragmentation on linux, there is. There are many solution that try to fix that: appimage, flatpak, snap and what not. All of them of some degree of success, and pitfalls. I, for example, am happy user of flapak, running steam games on a alpine distro without much problems. But for this specific thing I just don't get why there is a curl/bash command. It is a wide available piece of software that you can easily install using distro’s repo. Don't want to user terminal? Just download any "mainstream" distro and will have a store like software available, type micro, click install and done. Is there fragmentation in linux? Yes. Is is hard to guarantee it will work on every distro? Yes, a lot worse on software you can't compile. But micro IS NOT the demonstration of it. There is no reason whatsoever micro should have "curl | bash" on the front page.

gabrielgio 3y ago

It says when you run the installer: Note that you must install micro to a directory accessible to all users when doing this, typically /usr/bin. cd to that directory before running this script. E.g.: $ cd /usr/bin $ curl https://getmic.ro/r | sudo sh or $ su - root -c "cd /usr/bin; wget -O- https://getmic.ro | GETMICRO_REGISTER=y sh"

Karellen 3y ago
You conveniently missed off the lines of text above that which explain what "doing this" is: getmicro can use update-alternatives to register micro as a system text editor. For example, this will allow `crontab -e` open the cron file with micro. To enable this feature, define the GETMICRO_REGISTER variable or use the URL `https://getmic.ro/r`. Note that you must install micro to a directory accessible to all users when doing this... Yes, if you want to install `micro` as a system text editor, something you can do (but don't have to), you need privs. Again, so?
- gabrielgio 3y ago
  I know why it is asking for sudo and that was not my point. Again, my point is: you should never ask the user to run sudo from curl (or actually, don't curl to bash at all). There are plenty ways to sploit that. Again, I know it needs root to move the bin to a root owned folder or update the default editor, but, again, you should never ask (or suggest) the user to pipe shit from the internet, it is security risk. Also there is not even reason for it, micro is available in every distro.

codedokode 3y ago

This is just a demonstration of how unfriendly is Linux to supporting third-party software. You are supposed either to use software from distribution's repository or compile it yourself. And if you are a software developer, then you are on your own to decide how to support hundreds of different distributions (the most popular way is to statically compile everything into a single binary). Such scripts remind me of DOS-era "installers", and they are awful: - it is unknown whether your distribution is supported or not - this script is probably not tested on many distributions and can break something - it is unsafe, because you are running a code that some random person posted on the Internet without any sandboxing

gabrielgio 3y ago
No, it is not a demonstration of anything. I'm not saying there is no fragmentation on linux, there is. There are many solution that try to fix that: appimage, flatpak, snap and what not. All of them of some degree of success, and pitfalls. I, for example, am happy user of flapak, running steam games on a alpine distro without much problems. But for this specific thing I just don't get why there is a curl/bash command. It is a wide available piece of software that you can easily install using distro’s repo. Don't want to user terminal? Just download any "mainstream" distro and will have a store like software available, type micro, click install and done. Is there fragmentation in linux? Yes. Is is hard to guarantee it will work on every distro? Yes, a lot worse on software you can't compile. But micro IS NOT the demonstration of it. There is no reason whatsoever micro should have "curl | bash" on the front page.