3 ms·
Anything that suggests curl into bash just plain sketches me out. (edit: I know, this isn't totally rational, it just seems weird to me. We download and trust a
by walrus01 2mo ago
Anything that suggests curl into bash just plain sketches me out. (edit: I know, this isn't totally rational, it just seems weird to me. We download and trust a lot of software and run code from a bunch of package repositories as a regular activity...).
Git clone llama.cpp and build it, it's not hard.
https://github.com/ggml-org/llama.cpp/blob/master/docs/build.md https://github.com/ggml-org/llama.cpp/blob/master/docs/build...
literally just a few steps for the basics:
git clone https://github.com/ggml-org/llama.cpp https://github.com/ggml-org/llama.cpp
cmake -B build
cmake --build build --config Release
- ur-whale 2mo ago> Anything that suggests curl into bash just plain sketches me out. Yeah, 100% and it's becoming more and more of a thing, see rust install for example. OTOH, if you're installing llama.cpp, you're more than likely planning to run an LLM on your Linux box with an agentic harness, so a curl into bash thing might be the least of your security concerns, :-)
- walrus01 2mo agoOne way I prevent possible catastrophic fuckups is that the 'doing code work' box that runs opencode or pi or whatever, is its entirely own separate VM and desktop environment (running as a xen or kvm guest and with its own LVM logical volume as boot/root and /home disk), than the machine running llama-server itself. The harness gets the openai-compatible endpoint fed into it to talk to llama-server across the network, but the VM has no access whatsoever to my personal files, mail, backups/deep storage, fileserver, Documents folder, etc.
- jakkos 2mo ago> security concerns Yeah I recently tried the coding harness that's recommended here, Pi, in a bubble wrap sandbox and was horrified to learn that it spams multiple warnings at you if you don't give it write access to its own config/extension folder... Everyone else is rawdogging it I guess.
- etdznots 2mo agoI think the best course is a docker container or a VM, i agree with the sentiment but trying to restrict the permissions of these things is fighting an uphill battle, it’s probably best to let them reign king in a disposable and isolated environment
- elteto 2mo agoYou are horrified it needs access to its own stuff? I mean, any software that supports plugins needs access to them, no? How is that unreasonable? And with bwrap that’s an extra cli option.
- progval 2mo agoIt's okay-ish for Rust because you only need the curl|bash for Rustup, which is meant as a development environment. On production you can, for example, use APT to download it from Debian.
- thecopy 2mo ago>Anything that suggests curl into bash just plain sketches me out. How is it different than trusting any other method of installation? If URL has https and is from an author you trust i dont see the difference.
- danielrmay 2mo agoRendered text cannot be assumed to equal the underlying text, unfortunately
- cybrox 2mo agoDownload and inspect it.
- thecopy 2mo agoHow so? As i understand your point, this would mean we cannot trust GitHub enough to return the same content in git clone vs curl?
- danielrmay 2mo agoAs an example, webfonts can make rendered text differ from the underlying text that ends up on your clipboard.
- thecopy 2mo agoSure, but doesn't this assume that you cannot the publisher anyway? So why would you not trust their homepage but trust their source-code
- danielrmay 2mo ago[dead]
- walrus01 2mo agoI mean it's probably not, I just haven't got used to it yet. It's about the same level of security as installing a windows app on win2000 25 years ago and blindly downloading a .exe off the internet and running it to get into the install wizard. But indeed I also kind of blindly trust that whatever I'm getting from the debian trixie officially gpg-signed packages isn't backdoored. One thing I do not do as a matter of practice is install things with a ridiculous number of recursive npm dependencies.
- chaps 2mo agoYou're not wrong about the appearance of sketchiness of that, but.... dude, come on. "It's not hard" is only true because you already know how to do it.
- walrus01 2mo agoIt's literally three steps, assuming you have the equivalent of the debian "build-essential" dependencies installed on your system for cmake, compiler. It's the exact three rows of my post, pasted one at a time into the CLI. The llama-server build guide page is actually pretty good. I mean, sure, if there's people who can't figure that out, they're probably better off using a GUI that is a wrapper on top of somebody else's precompiled llama-server, like unsloth studio or lm studio. There's a good sized market for that and I wish them well.
- chaps 2mo agoYou're right about all of that up until the point any one of those commands doesn't work and you get a garglblargl amount of incomprehensible error messages. You've been in the sauce for so long that you've forgotten what it's like to start fresh in these things.
- walrus01 2mo agoPlease give it a try before you assume it won't work? Tell me what platform you're on and follow the three sequential cli commands I provided, and if it doesn't compile I'll be glad to look at your error message and get it going in the right direction.
- chaps 2mo agoYou're missing the trees for the forest, friend. I know how to troubleshoot this stuff. I wouldn't expect some random schmo who's just learning ubuntu for the first time to be able to. This, "just run these three commands" attitude is exactly the reason why these curl|sh "installers" have become popular.
- 2mo ago
- topiolli 2mo agoWhat would you win? Cmake is capable of executing shell commands and you end up with a binary that will execute on your machine anyway. At the end of the day it is just a matter of trust anyway, isn't it? I personally use bwrap if I'm not confident about the source. Cloning a repo and building it is not _that_ hard, but easy installation is often the thing that makes or breaks a product. I believe Ollama proves that point in this context.
- etdznots 2mo agoMostly agree but at least with git clone you have a hash and the malicious code has to be served to everyone, and GitHub is less likely to get hijacked by a malicious third party. But yes, still trusting the project with arbitrary code execution on your machine, including build formulas that pull stuff from the internet and suffer from all the above anyways
- deleted 2mo ago[deleted]
- epihelix 2mo agoThere are also prebuilt binary archives for just about any distribution and inference backend for the latest github release: https://github.com/ggml-org/llama.cpp/releases https://github.com/ggml-org/llama.cpp/releases No need to compile unless you really need to.
- usagisushi 2mo agoThis. I use mise's github backend `mise use --global --pin github:ggml-org/llama.cpp` to grab the release binaries for Linux, Windows and macOS.
- freehorse 2mo agoYou can also install it through homebrew https://formulae.brew.sh/formula/llama.cpp https://formulae.brew.sh/formula/llama.cpp
- vivzkestrel 2mo agodoesnt look like it is the desktop app, its just cli
- freehorse 2mo agobrew install --cask llama-app https://formulae.brew.sh/cask/llama-app https://formulae.brew.sh/cask/llama-app
- kelvinjps10 2mo agoit's also on the arch repos
- redmoonx 2mo ago[dead]
- drnick1 2mo agoAbsolutely, and it's even worse when you are asked to blindly download and run software like the Brave browser, which is open source but exclusively packaged and distributed by an adware company with a questionable history. The software itself is open source, but independent builds seem to be discouraged and no Linux distro packages Brave as a result. I built it myself in the past, but it takes close to two hours on a workstation and isn't worth the effort to keep it updated.
- timmmmmmay 2mo agoso instead of downloading a script with curl and running it with bash, you should download it with git and run it with cmake? if you aren't reviewing the code between download and execution, what's the difference?