3 ms·

The installation instructions being a `curl | sh` writing to the user's bashrc does not inspire confidence.

by lgtx 6mo ago

jjgreen 6mo ago
[flagged]
- Bjartr 6mo ago
  If you'd just left off "to fuck" you'd end up way less downvoted, if it even happened at all.
  - KPGv2 6mo ago
    [flagged]
    - jvanderbot 6mo ago
      Knowing the reason something is considered bad does not immediately change that fact that it is considered bad. Social / emotional signals still exist around that word.
  - jjgreen 6mo ago
    With fucks, without fucks, in iambic pentameter, anything vaguely critical of Rust will be downvoted. As you can see.
  - account42 6mo ago
    Probably not. This isn't prime time TV, some foul language is tolerated - but complaining about down-votes, especially preemptively, has a predictable response (IMO rightfully so).
    - jjgreen 6mo ago
      No complaints about down votes, simply warning the OP that (s)he will be getting some. Personally I quite like them, they indicate that I've irritated a Rust evangelist; that gives me a warm feeling inside.
ori_b 6mo ago
They did say it was inspired by cargo, which is often installed using rustup as such: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
- account42 6mo ago
  Sure but being inspired by something doesn't mean you have to cargo cult the worst aspects of it.
uecker 6mo ago
This is fitting for something simulating cargo, which is a huge supply chain risk itself.
bikelang 6mo ago
I don’t love this approach either (what a security nightmare…) - but it is easy to do for users and developers alike. Having to juggle a bunch of apt-like repositories for different distros is a huge time sink and adds a bunch of build complexity. Brew is annoying with its formulae vs tap vs cask vs cellar - and the associated ruby scripting… And then there’s windows - ugh. I wish there was a dead simple installer TUI that had a common API specification so that you could host your installer spec on your.domain.com/install.json - point this TUI at it and it would understand the fine grained permissions required, handle required binary signature validation, manifest/sbom validation, give the user freedom to customize where/how things were installed, etc.
maccard 6mo ago
Given you're about to run a binary, it's no worse than that.
- hyperhopper 6mo ago
  It is definitely worse. At leas a binary is constant, on your system, can be analyzed. Curl|sh can give you different responses than just curling. Far far worse
  - maccard 6mo ago
    Only if you download an analyse it. You’re free to download the install script and analyze that too in the same way. The advantage that the script has is it’s human readable unlike the binary you’re about to execute blindly.

The installation instructions being a `curl | sh` writing to the user's bashrc does not inspire confidence.

by lgtx 6mo ago

The installation instructions being a `curl | sh` writing to the user's bashrc does not inspire confidence.

jjgreen 6mo ago

[flagged]

Bjartr 6mo ago
If you'd just left off "to fuck" you'd end up way less downvoted, if it even happened at all.
- KPGv2 6mo ago
  [flagged]
  - jvanderbot 6mo ago
    Knowing the reason something is considered bad does not immediately change that fact that it is considered bad. Social / emotional signals still exist around that word.
- jjgreen 6mo ago
  With fucks, without fucks, in iambic pentameter, anything vaguely critical of Rust will be downvoted. As you can see.
- account42 6mo ago
  Probably not. This isn't prime time TV, some foul language is tolerated - but complaining about down-votes, especially preemptively, has a predictable response (IMO rightfully so).
  - jjgreen 6mo ago
    No complaints about down votes, simply warning the OP that (s)he will be getting some. Personally I quite like them, they indicate that I've irritated a Rust evangelist; that gives me a warm feeling inside.

ori_b 6mo ago

They did say it was inspired by cargo, which is often installed using rustup as such: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

account42 6mo ago
Sure but being inspired by something doesn't mean you have to cargo cult the worst aspects of it.

uecker 6mo ago

This is fitting for something simulating cargo, which is a huge supply chain risk itself.

bikelang 6mo ago

I don’t love this approach either (what a security nightmare…) - but it is easy to do for users and developers alike. Having to juggle a bunch of apt-like repositories for different distros is a huge time sink and adds a bunch of build complexity. Brew is annoying with its formulae vs tap vs cask vs cellar - and the associated ruby scripting… And then there’s windows - ugh. I wish there was a dead simple installer TUI that had a common API specification so that you could host your installer spec on your.domain.com/install.json - point this TUI at it and it would understand the fine grained permissions required, handle required binary signature validation, manifest/sbom validation, give the user freedom to customize where/how things were installed, etc.

maccard 6mo ago

Given you're about to run a binary, it's no worse than that.

hyperhopper 6mo ago
It is definitely worse. At leas a binary is constant, on your system, can be analyzed. Curl|sh can give you different responses than just curling. Far far worse
- maccard 6mo ago
  Only if you download an analyse it. You’re free to download the install script and analyze that too in the same way. The advantage that the script has is it’s human readable unlike the binary you’re about to execute blindly.