4 ms·

That's a misunderstanding. You can completely avoid the curl bash pattern if you can install the rustup binary and setup the relevant environment variables (lik

by goku12 1y ago

That's a misunderstanding. You can completely avoid the curl bash pattern if you can install the rustup binary and setup the relevant environment variables (like PATH) manually. Everything else, including cargo and various toolchain versions are installed and managed by rustup. And rustup doesn't have as much churn as the rest of the tools. So, rustup can be (and is) packaged for many distributions. That's all that's necessary in practice. They recommend curl bash because it automates all the above in a single script without exposing such lengthy explanations to a beginner.

superkuh 1y ago
>You can completely avoid the curl bash pattern if you can install the rustup binary and setup the relevant environment variables (like PATH) manually. Are you saying that if you avoid the curl bash pattern then you can avoid the curl bash pattern? This is true, and trivial, and completely irrelevant to what the rust website recommends and what most people do. There's definitely been a misunderstanding. The misunderstanding is that you think people are installing rust from rustup from their repos. The website shows you this is not the most common case. I do get your point that it doesn't have to be this way anymore. That rustup itself could be in repos and still work (even rustc/etc can't). But this is not not how it has been done for rust's entire existence and change is slow and hard. Is there a single distro that does do this now?
- kibwen 1y ago
  > That rustup itself could be in repos and still work So surely you acknowledge that rustup not being in any given distro's repo isn't something that the Rust developers have control over? How do you expect the Rust devs to distribute the compiler? If you want to build from source, that's extremely easy. For people who want convenient binaries, Rust also offers binaries via the most convenient means available, which is curl-to-bash. This isn't a security flaw any more than running the compiler itself is.
  - veber-alex 1y ago
    rustup is available on plenty of distros now, and it's on homebrew in macOS. The Rust docs should really offer installation methods other than curl | sh. Not from a security standpoint (I think that's nonsense) but I just don't like polluting my system with random stuff that is not managed by a package manager. Edit: Yes, there is an "other installation methods" link, but the text makes it sound like it is only applicable for Windows.
  - shadowgovt 1y ago
    This is probably the key idea in this specific context: the tool you're downloading is a compiler. If you don't trust the bash script hosted by the compiler's creators (assuming you're properly certificate-checking the curl connection and not bypassing TLS), why would you trust the compiler binary it's trying to install?
    - superkuh 1y ago
      I trust Debian to vet and package things in a way that won't break my desktop. I don't trust the Rust organization because their goals are very different.
      - shadowgovt 1y ago
        I'm not sure how that's relevant for rust. I'm trying to think of a way they could distribute the rust toolchain that would break your desktop; does your desktop have a native rust install that other pieces of the distro are relying on to have a particular configuration (like the gcc most distros ship with) that a curl | bash installed toolchain would interfere with?
      - mustache_kimono 1y ago
        > I trust Debian to vet and package things in a way that won't break my desktop. Um, has there been some instance where rustup broke a desktop? And I'm assuming Debian has actually delivered on this worst case scenario?
- goku12 1y ago
  > The misunderstanding is that you think people are installing rust from rustup from their repos. No. The misunderstanding is that you decided that I was talking about how people choose to install rustup, while I didn't even mention it. My reply was entirely about how the entire rust toolchain doesn't have to be in the distro repo. Here's the part in the original comment that I was referring to as a misunderstanding: > to install the rust development toolchain (because it changes too rapidly to effectively be in any repos). > This is true, and trivial, and completely irrelevant to what the rust website recommends and what most people do. Irrelevant to you perhaps. But it's a relevant detail if you're an individual user/developer who cares about security. It's easy to entirely skip the curl bash pattern for rust if you care enough. The question of why the website recommendeds it is moot because they wrote the script and vetted it among themselves. They have no reason to mistrust it. Meanwhile, the security culture of the user is not really their concern. It's not unreasonable for them to expect you to read a bash script before you download it from the net and execute it. I did, and that's how I realized that there are alternatives. If you think that it's unreasonable, look at how many projects, including programming languages recommend the same. The prevailing sentiment among the devs is clear - "Here's a script to do it easily. We haven't put anything harmful in it. But we assume that that's not enough guarantee for you. So just check the script first. It's just non obfuscated bash". I almost always find ways to avoid the curl bash step whenever a project recommends it. > Is there a single distro that does do this now? Enjoy the following articles in the Arch Linux, Gentoo and Debian wikis discussing the exact topic. Not only do they have rustup packaged in their repo, rustup even has build configurations to make it behave nicely with the rest of system in such a scenario (like following the FHS and disabling self updates). [1] https://wiki.archlinux.org/title/Rust#Arch_Linux_package https://wiki.archlinux.org/title/Rust#Arch_Linux_package [2] https://wiki.gentoo.org/wiki/Rust#Rustup https://wiki.gentoo.org/wiki/Rust#Rustup [3] https://wiki.debian.org/Rust https://wiki.debian.org/Rust
deleted 1y ago
[deleted]
pixelesque 1y ago
What exactly are you arguing? The Parent poster is arguing that the "recommended" way documented on the Rust website to install rustup is using curl bash, and you're saying "it's possible to do things manually". How is that helpful to the vast majority of the people on Mac/Linux trying to install Rust from scratch and reading the instructions on the website?
- navels 1y ago
  same parent had said "It's crazy that a language that prioritizes security so highly in it's design itself is only compiled through such insecure methods."
- goku12 1y ago
  > What exactly are you arguing? This part: > ... to install the rust development toolchain (because it changes too rapidly to effectively be in any repos) Rust toolchain is installed using rustup, not curl bash. It's rustup that's installed using curl bash. And while the site does recommend it, installing rustup alone securely is far easier than the entire toolchain. > How is that helpful to the vast majority of the people on Mac/Linux trying to install Rust from scratch and reading the instructions on the website? If you're concerned about running a remote script, just check how much work the script actually does. If it's not much, it may be worth exploring the alternative ways for it. For example, the rustup package in Arch Linux [1] does the same thing as what you get from curl bash. I have mise installed - another package which recommends installation using curl bash. But I don't use it, because it's really easy to install it manually. And when some other tool recommends curl bash, I check if it's supported by mise. As it turns out, rustup can be installed using mise [2]. [1] https://wiki.archlinux.org/title/Rust#Arch_Linux_package https://wiki.archlinux.org/title/Rust#Arch_Linux_package [2] https://mise.jdx.dev/lang/rust.html https://mise.jdx.dev/lang/rust.html

by goku12 1y ago

superkuh 1y ago

>You can completely avoid the curl bash pattern if you can install the rustup binary and setup the relevant environment variables (like PATH) manually. Are you saying that if you avoid the curl bash pattern then you can avoid the curl bash pattern? This is true, and trivial, and completely irrelevant to what the rust website recommends and what most people do. There's definitely been a misunderstanding. The misunderstanding is that you think people are installing rust from rustup from their repos. The website shows you this is not the most common case. I do get your point that it doesn't have to be this way anymore. That rustup itself could be in repos and still work (even rustc/etc can't). But this is not not how it has been done for rust's entire existence and change is slow and hard. Is there a single distro that does do this now?

kibwen 1y ago
> That rustup itself could be in repos and still work So surely you acknowledge that rustup not being in any given distro's repo isn't something that the Rust developers have control over? How do you expect the Rust devs to distribute the compiler? If you want to build from source, that's extremely easy. For people who want convenient binaries, Rust also offers binaries via the most convenient means available, which is curl-to-bash. This isn't a security flaw any more than running the compiler itself is.
- veber-alex 1y ago
  rustup is available on plenty of distros now, and it's on homebrew in macOS. The Rust docs should really offer installation methods other than curl | sh. Not from a security standpoint (I think that's nonsense) but I just don't like polluting my system with random stuff that is not managed by a package manager. Edit: Yes, there is an "other installation methods" link, but the text makes it sound like it is only applicable for Windows.
- shadowgovt 1y ago
  This is probably the key idea in this specific context: the tool you're downloading is a compiler. If you don't trust the bash script hosted by the compiler's creators (assuming you're properly certificate-checking the curl connection and not bypassing TLS), why would you trust the compiler binary it's trying to install?
  - superkuh 1y ago
    I trust Debian to vet and package things in a way that won't break my desktop. I don't trust the Rust organization because their goals are very different.
    - shadowgovt 1y ago
      I'm not sure how that's relevant for rust. I'm trying to think of a way they could distribute the rust toolchain that would break your desktop; does your desktop have a native rust install that other pieces of the distro are relying on to have a particular configuration (like the gcc most distros ship with) that a curl | bash installed toolchain would interfere with?
    - mustache_kimono 1y ago
      > I trust Debian to vet and package things in a way that won't break my desktop. Um, has there been some instance where rustup broke a desktop? And I'm assuming Debian has actually delivered on this worst case scenario?
goku12 1y ago
> The misunderstanding is that you think people are installing rust from rustup from their repos. No. The misunderstanding is that you decided that I was talking about how people choose to install rustup, while I didn't even mention it. My reply was entirely about how the entire rust toolchain doesn't have to be in the distro repo. Here's the part in the original comment that I was referring to as a misunderstanding: > to install the rust development toolchain (because it changes too rapidly to effectively be in any repos). > This is true, and trivial, and completely irrelevant to what the rust website recommends and what most people do. Irrelevant to you perhaps. But it's a relevant detail if you're an individual user/developer who cares about security. It's easy to entirely skip the curl bash pattern for rust if you care enough. The question of why the website recommendeds it is moot because they wrote the script and vetted it among themselves. They have no reason to mistrust it. Meanwhile, the security culture of the user is not really their concern. It's not unreasonable for them to expect you to read a bash script before you download it from the net and execute it. I did, and that's how I realized that there are alternatives. If you think that it's unreasonable, look at how many projects, including programming languages recommend the same. The prevailing sentiment among the devs is clear - "Here's a script to do it easily. We haven't put anything harmful in it. But we assume that that's not enough guarantee for you. So just check the script first. It's just non obfuscated bash". I almost always find ways to avoid the curl bash step whenever a project recommends it. > Is there a single distro that does do this now? Enjoy the following articles in the Arch Linux, Gentoo and Debian wikis discussing the exact topic. Not only do they have rustup packaged in their repo, rustup even has build configurations to make it behave nicely with the rest of system in such a scenario (like following the FHS and disabling self updates). [1] https://wiki.archlinux.org/title/Rust#Arch_Linux_package https://wiki.archlinux.org/title/Rust#Arch_Linux_package [2] https://wiki.gentoo.org/wiki/Rust#Rustup https://wiki.gentoo.org/wiki/Rust#Rustup [3] https://wiki.debian.org/Rust https://wiki.debian.org/Rust

deleted 1y ago

[deleted]

pixelesque 1y ago

What exactly are you arguing? The Parent poster is arguing that the "recommended" way documented on the Rust website to install rustup is using curl bash, and you're saying "it's possible to do things manually". How is that helpful to the vast majority of the people on Mac/Linux trying to install Rust from scratch and reading the instructions on the website?

navels 1y ago
same parent had said "It's crazy that a language that prioritizes security so highly in it's design itself is only compiled through such insecure methods."
goku12 1y ago
> What exactly are you arguing? This part: > ... to install the rust development toolchain (because it changes too rapidly to effectively be in any repos) Rust toolchain is installed using rustup, not curl bash. It's rustup that's installed using curl bash. And while the site does recommend it, installing rustup alone securely is far easier than the entire toolchain. > How is that helpful to the vast majority of the people on Mac/Linux trying to install Rust from scratch and reading the instructions on the website? If you're concerned about running a remote script, just check how much work the script actually does. If it's not much, it may be worth exploring the alternative ways for it. For example, the rustup package in Arch Linux [1] does the same thing as what you get from curl bash. I have mise installed - another package which recommends installation using curl bash. But I don't use it, because it's really easy to install it manually. And when some other tool recommends curl bash, I check if it's supported by mise. As it turns out, rustup can be installed using mise [2]. [1] https://wiki.archlinux.org/title/Rust#Arch_Linux_package https://wiki.archlinux.org/title/Rust#Arch_Linux_package [2] https://mise.jdx.dev/lang/rust.html https://mise.jdx.dev/lang/rust.html