3 ms·
Why would I need to install go to run this tool? I thought one advantage of go was that devs could just distribute a single binary file that works...
by g15jv2dp 2y ago
Why would I need to install go to run this tool? I thought one advantage of go was that devs could just distribute a single binary file that works...
- benterix 2y agoBecause it's a security tool so trusting a binary upfront defeats the purpose. With source you at least have the option to inspect what it really does.
- menacingly 2y agodoes the stated purpose of the tool influence whether or not you can trust it?
- spoonjim 2y agoIf you're trying to improve the security of your product by running random binaries from the Internet you're going to have a bad time
- saagarjha 2y agoThat's how most people run compilers
- benterix 2y agoThis is argumentum ad absurdum - there is a reason why trusting your kernel and compiler is a reasonable compromise, even though there might be security issues in them, but random pieces of software downloaded from the Internet is not.
- Ensorceled 2y agoWait ... you download random compilers from the internet? Or are you asserting equivalence between getting go from Google or Xcode from Apple and an random home brew install?
- menacingly 2y agoalso if you're not trying to improve the security of your product by running random binaries from the internet. I'm concerned at the inability to separate the concepts of "what it does" and "what it says it does". The idea that whether or not it needs scrutiny is impacted by your goals with the software is... creative
- alias_neo 2y agoI think that question is a little backwards. Certain tools are more likely to be used by people working in spaces where they should/must be less trusting. If there was a tool (there is) to scan my platform deployment against some NCSC/NSA guidance for platform security, and I wanted to use it, I'm likely operating in a space that should consider being cautious about running random tools I find on the internet.
- menacingly 2y agoright, but in that scenario I'd assume you'd also want to take a look at your ostensibly unrelated tools
- g15jv2dp 2y agoUh? OP just released a docker image and wants to release a homebrew thingy. Even assuming that was you say is somehow sensible, it's not the reason, no. You're just grasping at straws.
- lanfeust 2y agoI'd love to have it on homebrew but my PR is denied so I'll have to create my own brew tap or convince them to accept it. I'll also create a docker image. I just didn't expect this much popularity so the repo isn't 100% ready te be honest
- drexlspivey 2y agoMaking a tap is super easy, you just upload a file with 5 LoC to github. I wouldn’t even bother with brew core.
- lanfeust 2y agoOh ok I'll try then
- Too 2y agoThe docker image is nothing more than “FROM scratch” and then copying in the statically linked binary. If there are 0 other dependencies, I think it would be equally easy to distribute the binary through GitHub releases. There is no need for brew. If people want to run it isolated, the docker image is of course still a nice to have and docker hub is a convenient distribution mechanism. At the same time, an equivalent image can equally easily be created by the consumer. Personally, due to trust, I would anyway still build it from source and run in a container, to be on the safe side.
- lanfeust 2y agoThe docker container is now ready to use and documented on the home page