6 ms·

"curl -fsSL https://pi.dev/install.sh https://pi.dev/install.sh | sh" — seriously? That tells me a lot about the whole project, unfortunately.

by jwr 4mo ago

lo0pback 4mo ago
[dead]
tuvix 4mo ago
both the Julia and Rust programming languages use curl -> sh to install
- tovej 4mo ago
  Both of them provide that option. I've never installed rust without a package manager. Why would I?
  - qarl2 4mo ago
    > Why would I? Because then you can install it without depending on a package manager?
    - tovej 4mo ago
      Yeah, from source in that case. Or using a verified binary if I absolutely had to.
      - qarl2 4mo ago
        Yes, if you want to, you can do that. Understand that 99% are comfortable trusting downloads. They know that it's just as easy to sneak backdoors into source code as it is to sneak backdoors into executables. See also: XZ hack.
        tovej 4mo ago
        99% of developers are most definitely not comfortable piping a script into the shell. I would never runa script without reviewing it. I would install a package from a distros repository without reviewing the contents, however, because I can trust that a distro maintainer has reviewed it, that anyone else in the community can review it, and that that the bytes I'm downloading are the specific bytes I'm supposed to be downloading. If you run a script off the open internet, you're being massively irresponsible. There are so many attack vectors that could be used here, and they are much easier to implement than something like the massive social engineering attack that was XZ.
        qarl2 4mo ago
        As someone who has spent years in the software industry in silicon valley - My experience does not match yours.
        tovej 4mo ago
        I didn't realize silicon valley was full of software cowboys. Well, I suppose that matches the "move fast and break things" credo. lol.
    - HDBaseT 4mo ago
      Depending on a package manager has its benefits. I personally try and use my operating systems package manager for all applications (in this instance, dnf on Fedora). The moment you start adding a million repos, third party package managers, Flatpaks, Snaps, random curl install scripts, etc, it becomes extremely unmaintainable. What happens if the curl application depends on openssl, maybe with a legacy or specific cryptographic function? I assume the curl script will either install the required version, or include the relevant libraries right? Now that is outside of the system package managers scope, meaning updating openSSL to avoid some vuln now requires extra work. What happens when you go from Fedora 44 to 45? You should be checking all your applications are supported on whatever version or operating system you are running. There is a decently high chance you run into dependency issues when some lib version is updated. Package Managers are (generally) more secure and simple to use for an end user (they are using the OS to begin with). Curl scrips are easier for the software developers.
      - qarl2 4mo ago
        Sure. Agreed. I do it myself. But sometimes people don't do that. Sometimes people don't care about that at all. And it's not just sometimes - it's most people. So. They have their option too. And it's at the top, where most people can find it.
    - Ferret7446 4mo ago
      What an odd comment. "You can mine and refine your own iron ore so you can have a metal fork without depending on modern infrastructure." Sure, but why.
      - qarl2 4mo ago
        It doesn't matter why. Many people choose to do it that way. And if you want them to use your software, you need to enable them. But to answer your question directly - I suspect they simply don't care, and just take the easiest way.
throwaway2027 4mo ago
Claude Code does it the same way (which doesn't excuse it obviously) but still. curl -fsSL https://claude.ai/install.sh https://claude.ai/install.sh | bash https://code.claude.com/docs/en/quickstart https://code.claude.com/docs/en/quickstart
- ardacinar 4mo ago
  Yep, that's not an excuse. Claude goes down all the time, should pi also go down? Oh wait (from another comment under this article): > https://pi.dev/models https://pi.dev/models is throwing an internal server error for me.
mik3y 4mo ago
I am genuinely curious what it tells you, as "curl https//.. | sh" has long been an enormously popular approach to distribution in the open source world. Homebrew, to name just one example, advertises a similar method. (pi.sh also documents other install methods, like `npm`, on their homepage) If trust and security is the issue, unfortunately "better" ideas like hashpipe [1] never achieved critical mass [1] https://news.ycombinator.com/item?id=9318286
- tovej 4mo ago
  What about better ideas like installing from source, or using a package manager? Or even flatpaks.
  - mik3y 4mo ago
    The ideas aren't mutually exclusive, and I've never seen an open source project support "curl | sh" without also supporting those methods. Indeed, plenty of these scripts often act as a "what OS and packager do we have" mux. Just look at the source of this one, for example. When you support an open source project at scale and/or with less savvy users, you come to see the benefit of "here, just f'ing slam this into your shell and we'll figure it out" installers. I know I have.
    - ithkuil 4mo ago
      There are many ways of implementing a curl | sh installer, some of them robust, some of them not. However they all look the same to the end user. That's a feature and also a potential source of problems since users cannot tell if that particular application they want to install Is implementing the installer correctly or not. The outcome is that most users just trust that application (possibly because it's popular and trusted) and that's fine but it also trains the public that this installation method is ok and that gives a positive feedback for other applications to also offer their software using that installer pattern until at least one of such packages is implemented very badly or sneakily malicious. If only a curl had a flag where you pass the sha256 of the file and it first checks it against the buffered file before outputting it to stdout. That would singlehandedly resolve this whole kerfuffle. The install instructions will be a slightly longer one liner and that's fine because people copy paste it anyway
Arubis 4mo ago
I get this, and would recently have had a similar reaction. But I have to ask: do you typically run your agent harness in yolo mode?
plagiarist 4mo ago
In general I agree with you, but on the other hand it is an agentic coding agent you should have isolated in a container or VM anyway
efficax 4mo ago
it tells you they're just like basically every other CLI targeting project for the last 15 years? I mean is it a big security hole we all accept, yes, it is. But it's not really indicative of much. That's also how I install rust.
- croes 4mo ago
  We also accepted the security risks of npm and such and we get one supply chain attack after another. Maybe security should be at a higher position on our priority list. The careless days are ultimately over but we still don’t act like that.
horsawlarway 4mo ago
Yeah, totally reasonable comment given the utter security that must come from anthropic with their installer, amiright? oh wait... "curl -fsSL https://claude.ai/install.sh https://claude.ai/install.sh | bash" (right from https://claude.com/product/claude-code https://claude.com/product/claude-code) Further - what the flicking fuck do you think an installer is going to do on your system? Not run any commands? Because I've written installers for every platform... they ALL can run commands. So what exactly is the complaint in this comment? If you want to go read the install script - knock yourself out (or hell, point your agent at it...).
- kordlessagain 4mo ago
  And you can simply look at the installer by pulling it up in the browser.
  - qarl2 4mo ago
    You can simply look at the installer by leaving off the "| bash".
qarl2 4mo ago
My dude - if you're going to trust them then you're going to trust them. You think it's hard to obfuscate shell calls from inside a built executable? What it tells us is that you're probably searching for reasons to grouse about AI.
sippeangelo 4mo ago
Seriously, what is the threat model here?
- arbll 4mo ago
  Nah bro package manager where you copy and paste their custom repo and key from the same website that hosts the `.sh` is definitely safer, trust me /s
- InsideOutSanta 4mo ago
  There is no threat model that doesn't also apply to pretty much every other distribution method. It's just people who have internalized "don't paste commands from the Internet into your terminal" and aren't thinking about exactly what makes pasting commands from the Internet into your terminal dangerous, and how that applies to this specific case.
  - Ferret7446 4mo ago
    Compromised web server, since they don't tend be as secure. Signed packages are safer as signing keys are generally more secured than web servers.

"curl -fsSL https://pi.dev/install.sh https://pi.dev/install.sh | sh" — seriously? That tells me a lot about the whole project, unfortunately.

by jwr 4mo ago

"curl -fsSL https://pi.dev/install.sh https://pi.dev/install.sh | sh" — seriously? That tells me a lot about the whole project, unfortunately.

lo0pback 4mo ago

[dead]

tuvix 4mo ago

both the Julia and Rust programming languages use curl -> sh to install

tovej 4mo ago
Both of them provide that option. I've never installed rust without a package manager. Why would I?
- qarl2 4mo ago
  > Why would I? Because then you can install it without depending on a package manager?
  - tovej 4mo ago
    Yeah, from source in that case. Or using a verified binary if I absolutely had to.
    - qarl2 4mo ago
      Yes, if you want to, you can do that. Understand that 99% are comfortable trusting downloads. They know that it's just as easy to sneak backdoors into source code as it is to sneak backdoors into executables. See also: XZ hack.
      - tovej 4mo ago
        99% of developers are most definitely not comfortable piping a script into the shell. I would never runa script without reviewing it. I would install a package from a distros repository without reviewing the contents, however, because I can trust that a distro maintainer has reviewed it, that anyone else in the community can review it, and that that the bytes I'm downloading are the specific bytes I'm supposed to be downloading. If you run a script off the open internet, you're being massively irresponsible. There are so many attack vectors that could be used here, and they are much easier to implement than something like the massive social engineering attack that was XZ.
        qarl2 4mo ago
        As someone who has spent years in the software industry in silicon valley - My experience does not match yours.
        tovej 4mo ago
        I didn't realize silicon valley was full of software cowboys. Well, I suppose that matches the "move fast and break things" credo. lol.
  - HDBaseT 4mo ago
    Depending on a package manager has its benefits. I personally try and use my operating systems package manager for all applications (in this instance, dnf on Fedora). The moment you start adding a million repos, third party package managers, Flatpaks, Snaps, random curl install scripts, etc, it becomes extremely unmaintainable. What happens if the curl application depends on openssl, maybe with a legacy or specific cryptographic function? I assume the curl script will either install the required version, or include the relevant libraries right? Now that is outside of the system package managers scope, meaning updating openSSL to avoid some vuln now requires extra work. What happens when you go from Fedora 44 to 45? You should be checking all your applications are supported on whatever version or operating system you are running. There is a decently high chance you run into dependency issues when some lib version is updated. Package Managers are (generally) more secure and simple to use for an end user (they are using the OS to begin with). Curl scrips are easier for the software developers.
    - qarl2 4mo ago
      Sure. Agreed. I do it myself. But sometimes people don't do that. Sometimes people don't care about that at all. And it's not just sometimes - it's most people. So. They have their option too. And it's at the top, where most people can find it.
  - Ferret7446 4mo ago
    What an odd comment. "You can mine and refine your own iron ore so you can have a metal fork without depending on modern infrastructure." Sure, but why.
    - qarl2 4mo ago
      It doesn't matter why. Many people choose to do it that way. And if you want them to use your software, you need to enable them. But to answer your question directly - I suspect they simply don't care, and just take the easiest way.

throwaway2027 4mo ago

Claude Code does it the same way (which doesn't excuse it obviously) but still. curl -fsSL https://claude.ai/install.sh https://claude.ai/install.sh | bash https://code.claude.com/docs/en/quickstart https://code.claude.com/docs/en/quickstart

ardacinar 4mo ago
Yep, that's not an excuse. Claude goes down all the time, should pi also go down? Oh wait (from another comment under this article): > https://pi.dev/models https://pi.dev/models is throwing an internal server error for me.

mik3y 4mo ago

I am genuinely curious what it tells you, as "curl https//.. | sh" has long been an enormously popular approach to distribution in the open source world. Homebrew, to name just one example, advertises a similar method. (pi.sh also documents other install methods, like `npm`, on their homepage) If trust and security is the issue, unfortunately "better" ideas like hashpipe [1] never achieved critical mass [1] https://news.ycombinator.com/item?id=9318286

tovej 4mo ago
What about better ideas like installing from source, or using a package manager? Or even flatpaks.
- mik3y 4mo ago
  The ideas aren't mutually exclusive, and I've never seen an open source project support "curl | sh" without also supporting those methods. Indeed, plenty of these scripts often act as a "what OS and packager do we have" mux. Just look at the source of this one, for example. When you support an open source project at scale and/or with less savvy users, you come to see the benefit of "here, just f'ing slam this into your shell and we'll figure it out" installers. I know I have.
  - ithkuil 4mo ago
    There are many ways of implementing a curl | sh installer, some of them robust, some of them not. However they all look the same to the end user. That's a feature and also a potential source of problems since users cannot tell if that particular application they want to install Is implementing the installer correctly or not. The outcome is that most users just trust that application (possibly because it's popular and trusted) and that's fine but it also trains the public that this installation method is ok and that gives a positive feedback for other applications to also offer their software using that installer pattern until at least one of such packages is implemented very badly or sneakily malicious. If only a curl had a flag where you pass the sha256 of the file and it first checks it against the buffered file before outputting it to stdout. That would singlehandedly resolve this whole kerfuffle. The install instructions will be a slightly longer one liner and that's fine because people copy paste it anyway

Arubis 4mo ago

I get this, and would recently have had a similar reaction. But I have to ask: do you typically run your agent harness in yolo mode?

plagiarist 4mo ago

In general I agree with you, but on the other hand it is an agentic coding agent you should have isolated in a container or VM anyway

efficax 4mo ago

it tells you they're just like basically every other CLI targeting project for the last 15 years? I mean is it a big security hole we all accept, yes, it is. But it's not really indicative of much. That's also how I install rust.

croes 4mo ago
We also accepted the security risks of npm and such and we get one supply chain attack after another. Maybe security should be at a higher position on our priority list. The careless days are ultimately over but we still don’t act like that.

horsawlarway 4mo ago

Yeah, totally reasonable comment given the utter security that must come from anthropic with their installer, amiright? oh wait... "curl -fsSL https://claude.ai/install.sh https://claude.ai/install.sh | bash" (right from https://claude.com/product/claude-code https://claude.com/product/claude-code) Further - what the flicking fuck do you think an installer is going to do on your system? Not run any commands? Because I've written installers for every platform... they ALL can run commands. So what exactly is the complaint in this comment? If you want to go read the install script - knock yourself out (or hell, point your agent at it...).

kordlessagain 4mo ago
And you can simply look at the installer by pulling it up in the browser.
- qarl2 4mo ago
  You can simply look at the installer by leaving off the "| bash".

qarl2 4mo ago

My dude - if you're going to trust them then you're going to trust them. You think it's hard to obfuscate shell calls from inside a built executable? What it tells us is that you're probably searching for reasons to grouse about AI.

sippeangelo 4mo ago

Seriously, what is the threat model here?

arbll 4mo ago
Nah bro package manager where you copy and paste their custom repo and key from the same website that hosts the `.sh` is definitely safer, trust me /s
InsideOutSanta 4mo ago
There is no threat model that doesn't also apply to pretty much every other distribution method. It's just people who have internalized "don't paste commands from the Internet into your terminal" and aren't thinking about exactly what makes pasting commands from the Internet into your terminal dangerous, and how that applies to this specific case.
- Ferret7446 4mo ago
  Compromised web server, since they don't tend be as secure. Signed packages are safer as signing keys are generally more secured than web servers.