3 ms·

I'd not heard of clickhouse before. It does seem interesting, but I just can't get behind a project that says: > The easiest way to download the latest version

I'd not heard of clickhouse before. It does seem interesting, but I just can't get behind a project that says: > The easiest way to download the latest version is with the following command: > curl https://clickhouse.com/ https://clickhouse.com/ | sh Like, sure, there is some risk downloading a binary or running an arbitrary installer. But this is just nuts.

gigatexal 1y ago
Chdb is just a binary. You can just grab that. Also pipe to sh is used by a ton of projects
- bflesch 1y ago
  it's used by many projects but still regarded as an anti-pattern and security issue
  - monerozcash 1y ago
    it's really exactly the same as wget file;./file and not a real anti-pattern in any way
- Etheryte 1y ago
  A ton of people drink and drive too, doesn't make it any more fine.
  - gigatexal 1y ago
    Y’all are so pure. Just don’t install it that way. Sheesh.
Aefiam 1y ago
how is this any less secure than running a binary/installer? the binary could run this inside?
trollbridge 1y ago
It's Apache licenced and you could also install it via your favourite package installer. Given all the crazy supply chain attacks going on, I don't really feel this is any worse than downloading a binary from a distro archive, and specifically this pipe | sh doesn't expect you to run it as root (which a lot of other cut-and-paste installers do).
- xorcist 1y ago
  > I don't really feel this is any worse than downloading a binary from a distro archive Please don't say that. It denigrates the work of all the packagers that actually keep our supply chains clean. At least in the major distributions such as Red Hat/Fedora and Debian/Ubuntu. The distro model is far from perfect and there are still plenty of ways to insert malware into the process, but it certainly is far better than running binaries directly from a web page. You have no idea who have access to that page and its mirrors and what their motives are. The binary isn't even signed, let alone reviewed by anyone!
  - trollbridge 1y ago
    I’m not sure how much better this is the man blindly “npm i thing”, where I have no real assurance I’m not downloading a giant piece of malware either.
    - da_chicken 1y ago
      That's exactly why it's insane. People remember the pad-left fiasco. Previously discussed here: https://news.ycombinator.com/item?id=11348798 https://news.ycombinator.com/item?id=11348798 Article now resides here: https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how-to-program/ https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how...
monerozcash 1y ago
>Like, sure, there is some risk downloading a binary or running an arbitrary installer. But this is just nuts. It's literally exactly the same thing

gigatexal 1y ago

Chdb is just a binary. You can just grab that. Also pipe to sh is used by a ton of projects

bflesch 1y ago
it's used by many projects but still regarded as an anti-pattern and security issue
- monerozcash 1y ago
  it's really exactly the same as wget file;./file and not a real anti-pattern in any way
Etheryte 1y ago
A ton of people drink and drive too, doesn't make it any more fine.
- gigatexal 1y ago
  Y’all are so pure. Just don’t install it that way. Sheesh.

Aefiam 1y ago

how is this any less secure than running a binary/installer? the binary could run this inside?

trollbridge 1y ago

It's Apache licenced and you could also install it via your favourite package installer. Given all the crazy supply chain attacks going on, I don't really feel this is any worse than downloading a binary from a distro archive, and specifically this pipe | sh doesn't expect you to run it as root (which a lot of other cut-and-paste installers do).

xorcist 1y ago
> I don't really feel this is any worse than downloading a binary from a distro archive Please don't say that. It denigrates the work of all the packagers that actually keep our supply chains clean. At least in the major distributions such as Red Hat/Fedora and Debian/Ubuntu. The distro model is far from perfect and there are still plenty of ways to insert malware into the process, but it certainly is far better than running binaries directly from a web page. You have no idea who have access to that page and its mirrors and what their motives are. The binary isn't even signed, let alone reviewed by anyone!
- trollbridge 1y ago
  I’m not sure how much better this is the man blindly “npm i thing”, where I have no real assurance I’m not downloading a giant piece of malware either.
  - da_chicken 1y ago
    That's exactly why it's insane. People remember the pad-left fiasco. Previously discussed here: https://news.ycombinator.com/item?id=11348798 https://news.ycombinator.com/item?id=11348798 Article now resides here: https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how-to-program/ https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how...

monerozcash 1y ago

>Like, sure, there is some risk downloading a binary or running an arbitrary installer. But this is just nuts. It's literally exactly the same thing