7 ms·
> Javascript plus a "curl | sudo sh" attitude to life equals "yeah no, I am never touching this thing". I get why there are people that don’t like how some ins
by karlshea 3y ago
> Javascript plus a "curl | sudo sh" attitude to life equals "yeah no, I am never touching this thing".
I get why there are people that don’t like how some installers do this, but this trope is really turning into the “but I don’t even own a TV” of OSS commentary.
Just use the Docker image if you don’t like it. Or get their appliance which actually supports ongoing development.
- Cyph0n 3y agoAgreed. Another alternative: run HAOS in a VM.
- seanp2k2 3y agoI don't like how HAOS is the only currently-supported way to use the SkyConnect to get Zigbee + Matter support currently, and messing with firmware on the SkyConnect was exactly the opposite reason why I got one in the first place. It doesn't "just work", even for just ZigBee, and now I've sunk hours into troubleshooting it without a working ZigBee setup in HA. Meanwhile, the Sonoff ZigBee bridge worked flawlessly the first time setting it up with my phone and their eWeLink app. Smart Home 2023Q3 status: still for hackers only if you want more than a few lightswitches that you can just toggle from your phone, and even if you do want that, stick to one vendor + system only.
- jacquesm 3y agoAfter a few days with ZigBee I was ready for an extended vacation. Finally got rid of the whole thing and everything is on a dedicated WiFi network now that is an integral part of the house, in other words: if I sell this house that WiFi network + all HA stuff goes with it including a nice manual of how it all hangs together. Highly recommended: Shelly gear, it is easy to configure and seems to be rock solid, I've got a bunch of their remote control radiator valves, several remote control relays and a tri-phase consumption/production meter. It all worked flawlessly since installation. And instead of a regular Pi I got one that was built into a keyboard. It was mostly because I couldn't get a bare one but in the end I think this was the better option.
- jamiek88 3y ago> if I sell this house that WiFi network + all HA stuff goes with it including a nice manual of how it all hangs together I had something similar. Rock solid. Wired back haul. Nice manual. I knew it wouldn’t add $$$ to the house but I was a little surprised to find out it actually put a lot of people off. It had negative value as I had to rip it out and go analog. Even nerds looking at the house wanted to do their own thing not maintain someone else's ideal and normies refused to spend ANY mental energy on understanding it. Was eye opening!
- jacquesm 3y agoThat could well happen, so, for that eventuality I have a little cardboard box with the old radiator valves and thermostat. The solar panels and the inverters would be a bigger issue though, this all runs locally, not in the cloud (it was a bit of a job to find inverters that do not require a cloud connection, what a nonsense that is). But given that altogether these give the house its A++++ energy label (it is in the top .1% or so for houses of this size and age with respect to energy consumption) I'm pretty sure that buyers would be A-ok with it. Energy efficiency is a massive factor in people's buying decision here (as well as location and general state of the house, obviously). But your point is well taken and I'll be sure to introduce the subject at the handover if it ever comes to that.
- jamiek88 3y agoAh well you are in good shape then. Energy efficiency was my main goal too but no one gives a fuck about that here either so it’s a different market.
- jacquesm 3y agoHere it's a mandatory disclosure item and it's important enough that you can filter by it on the real estate listing sites. More so because now house insulation comes with a mandatory 'bat study' requirement which is absolutely bonkers. So houses that are already energy efficient are at a premium. What also helps is that the whole system runs without any user intervention. The manual is mostly aimed at people hired to add stuff at some point in the future, or in case something breaks.
- Cyph0n 3y agoI definitely have a small setup, but getting ZigBee running was fairly straightforward. Two steps: 1) buy a ConBee dongle and 2) install and setup Zigbee2MQTT. I’ve never dealt with Matter, though.
- cyberax 3y agoYou can get ZigBee with any number of adapters (I'm using HUZBZB-1), and Matter right now is not worth it anyway. I bought a SkyConnect adapter to support HAOS, but it's probably going to be unused for at least another year.
- jyrkesh 3y ago+1 for the HUZBZB-1. I waxed more poetically about my setup already[1], but I've had that little guy for over 4 years, it was plug-and-play on day 1, and I've never had a single issue with a Zigbee or Z-Wave device. (Wi-Fi? don't even get me started...) And yeah, it'll be another year or two before Matter/Threads really starts picking up steam. I'll just pick up a new dongle when there's 10 of 'em in that same timeframe. (Disclaimer: my house is 800 sqft and I don't share any walls with neighbors. Zigbee is SUPPOSED to be mesh and Just Work assuming you have enough devices, but I can't speak from experience on that front.) [1] https://news.ycombinator.com/item?id=37667266 https://news.ycombinator.com/item?id=37667266
- jrockway 3y agoI think if you stick with Homekit certified accessories you can probably have a multi-vendor setup that's OK. Homekit can be flaky at times, though, and I would definitely recommend Home Assistant instead if you are a hacker.
- tmpX7dMeXU 3y agoI bought a cheap ConBee (is that what it’s even called?) Zigbee USB dongle, plugged it in, passed it through to my HA container, and it’s flawless. Plenty of things you can knock HA for, but good ZigBee support is easily attainable. I have…a large setup. 30 lights, door locks, ZigBee switches, blah blah blah. And I’m not smart guy. Such an improvement over WiFi
- Izkata 3y agoThis is even better than the docker version, because it's able to set up a bunch of stuff for you that you'd have to do manually with docker, like the current ZWave integration.
- akerl_ 3y agoYea; I run HomeAssistant via the official Docker container and have been pretty happy with it. It's only accessible on my local network, and my phone/laptop/etc use Wireguard to talk to it if I'm somewhere else.
- fortyseven 3y agoJust installed that, myself. Same way. Instantly worked. Kicking myself for not installing this sooner, it's pretty rad.
- nucleardog 3y agoOnce you’re kind of settled there take a look at NodeRED. Integrates really cleanly with Home Assistant and for most of the kinds of people on HN that are already technically inclined, it makes much more complex automations and integrations a piece of cake.
- XorNot 3y agoYep this is how I'm doing it. Combined with ESPHome I've got a nice, local-only automation system using sourceable off-the-shelf parts (but I'm so, so happy that Athom are making open-source flashed IoT devices - which go and live on my IoT network).
- nunez 3y agoNote that you don't need the Community Store if you're running HA via Docker. Every plugin that is in that store must have a custom_components folder. Drop that into the bind-mounted volume holding HA's configuration.yaml and restart. HA will pick it up automatically, and you'll be able to install it in Integrations and Devices.
- bryancoxwell 3y agoAlso, no one’s forcing you to pipe curl into sudo sh. I don’t think a software project listing this as an installation method is that big of a red flag to be honest.
- op00to 3y agoI’ve … never piped curl for home assistant.
- hk1337 3y agoYeah, you could always just curl it first and see what it’s going to do.
- posnet 3y agoIt can be detected if your adversaries are clever enough: https://lukespademan.com/blog/the-dangers-of-curlbash/ https://lukespademan.com/blog/the-dangers-of-curlbash/
- thinkmassive 3y agoCongrats, you just defeated the attack by manually downloading the script before running it!
- post- 3y agoTbh, I’m put on more on alert by the spelling errors in the linked post than I am by the ostensible threat of a server timing my requests in order to serve malware. It’s good practice to check anything that you’ll pipe to `sudo`, but this article’s level of paranoia is kind of self-defeating, no? At some point, we all trust the things we run on our machines. We rely on communities — and our participation in them — to vet installations. There is no perfect solution. Someone will always be misled.
- jrockway 3y agoWhy is "sudo" emphasized so heavily, anyway? Running as your ordinary user, that shell script can send someone your session cookies, authenticate with your SSH agent, and really anything that you can do. Sure, maybe not running as root protects the integrity of the OS and prevents some persistent keylogging attacks, but honestly... you don't need a keylogger when you just grab the cookies, or install your own binaries farther up in the path (good old ~/.local/bin/firefox instead of /usr/bin/firefox). Frankly, being anything other than super paranoid is almost a little reckless. Also, shit-talking Home Assistant is a pretty weird take. I wouldn't write it in Python configured half in YAML and half in SQLite either, but ... not having to write it myself was the fun part.
- Waterluvian 3y agoSurely these are the same kinds of people who will carefully review all scripts before running them, right?
- serf 3y agopeople act weird around any kind of script, more-so than executables, i've never really understood it. I periodically get told that a published browser userscript of mine is malicious or suspicious in emails simply because of the cautions and wording around the userscript installers themselves (it's just a css tweak, a theme), meanwhile the executables I have in the wild have generated zero similar feedback. my theory is that since the script is more easily read that it attracts people to read it without any theory or knowledge of what they're even looking at .
- Waterluvian 3y agoThis feels like a thing but I can’t think of a name for it. Where something that can be verified gets more scrutiny than something that can’t. Maybe someone else knows.
- muppetman 3y agoRight? I felt stupid for having read the rest of his post when I saw this nonsense and I closed the tab.
- the_af 3y ago> his Her. Rachel is a woman. Pretty knowledgeable and experienced, too, so I would at least consider what she's saying.
- SoftTalker 3y agoI mean, what do you think the installer is doing anyway?
- Rapzid 3y agotiny_installer.sh #! /bin/bash curl www.url-you-didnt-check.dev/the-real-installer.sh | sudo bash -
- KennyBlanken 3y agoAnd what does OP think a ton of commercial installers do? Half of them just download an archive and unpack it.
- SoftTalker 3y agoYes, exactly the point I was trying to make. curl | sudo bash is just making it obvious what the glossy GUI installer with its dialog boxs and animated progress meters is doing anyway.
- Rapzid 3y agoYeah, the industry has settled on it's fine with some caveats. Even Microsoft has this published for the dotnet install tool: curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin <additional install-script args> Microsoft.. The only company I have ever heard mention CRIME and BREACH and invokes their specter in .Net to do awesome things like.. Not let you enable websocket compression in SignalR.
- gregopet 3y agoOf course Microsoft is fine with it - the official Windows way of installing things has forever been "Pssst, hey there, why don't you download this .exe and run it and keep pressing ok until it's done"
- Rapzid 3y agoHow is this much different than how a deb or something gets installed? Actually, Windows installers are expected to be signed by default and it'll warn you if they aren't.
- chomp 3y agoI wasn’t even aware this was a supported installation method anymore. If it is, it’s hidden on the site. When was the author’s last experience with homeassistant? If the answer to cloud enshittification is “I know! I’ll use a different company’s solution instead of this open source project because I want to make an outdated stand against curl|bash” then I think the thought process is misguided.
- snapetom 3y agoHomeAssistant has changed officially supported installation methods so much, I personally don't know what's supported. Docker, tarball, installer, their own OS Part 1, etc were all different ways you can run it. Last I checked, the bare metal pip3 method was "always" going to be supported. So the "Just use Docker" comments ignore this. The author complains about a lack of product leadership at Phillips, but HA has always been renown for ignoring their users.
- XorNot 3y agoHAOS has been a pretty good experience when I set it up at my parents house though. I don't begrudge HA from trying to figure out the most reliable way to support installation methods - they're in a complicated space, and techies like us do tend to build unique-snowflake home setups. I'm running the docker container (since I already had a home server running docker containers), but a NUC with HAOS for my folks has been working great.
- snapetom 3y agoI do begrudge them for putting in placeholders for features for years that weren't functional. Like a map that was blank and entire sections that weren't functional. I also begrudge them for doing things like removing Python 3.7 support 1.5 years before it was EOL. I begrudge them for re-architecting entire features like Open Z-Wave three times over the five years I used them. I begrudge them for asking their projects be removed from other open source projects. HA is one guy's pet project to goof around with the latest and greatest technologies.
- 3y ago
- tjbiddle 3y agoI've never understood this. Sure, don't do that as is - But it's not hard to just curl the script, read it to confirm it looks okay, then run it.
- lamontcg 3y agoHas anyone actually been hacked by a curl|bash installer because of the curl-bash-iness of it (and not a theoretical PoC--I'm well aware of those blog posts)?
- nocoiner 3y agoMaybe I’m just a naive idiot, but I thought her point was not the danger of sudo’ing random shell scripts per se but any sort of “solution” to restore the prior capabilities of a consumer product that required that level of technical acumen. But every single other reply seems to be either “well yeah obviously read the script first” or “how dumb, just use docker,” so like I said, maybe I’m the dumb one.
- boringg 3y agoI mean its really putting all the onus on the buyer of the product in the hopes that they have technical capabilities or alternatively just stilling all the benefits to the corporate company. Sad state of play.
- jcutrell 3y agoI think her point is that managing your home automation through this level of involvement is not the end goal she’s looking for. I may be wrong, but it sounds like she wants stuff to plug in and work without having to go down the road of setting up custom automation stitching stuff. I love Home Assistant, but I regularly find myself opening the Hue and Lutron apps anyway. And I’m someone who runs a NUC. I don’t mind administration, but I don’t want to HAVE to do that when I’ve already paid for a thing that supposedly does most of that.
- deleted 3y ago[deleted]