4 ms·

And in the GitHub release page they include compiled binaries anyway... Why would you advertise `curl | bash` as a way to install if there's a binary available?

• seanw444 2mo ago
  Convenience. That's usually the answer.
  • rbanffy 2mo ago
    One thing I dislike is that the installer wants super user permissions. That’s a big no-no with JavaScript apps installing global components. All global machine state should be managed with package managers, preferably only one package manager.
• munksbeer 2mo ago
  It seems to have become "the thing" to do. I can't figure out if it is bad as it feels. Why would I run `curl | bash` on something that could be doing literally anything. It feels crazy that all the lessons we've learned just get thrown away. On the other hand, just because I run `brew install someapp`, it somehow feels safer, but why? That app could be doing anything too.
  • wett 2mo ago
    I just learned these two: 1. If the connection dies mid transfer, bash will still execute it. So `rm -rf ~/.local/bin/whatever` can become `rm -rf ~` The author can avoid this by wrapping everything in a function. But you wouldn’t know if they did so if you aren’t outputting it to a file first. 2. Say the link points to an S3 bucket and it gets compromised, there’s no record of the payload to analyze. I’m sure there’s a plethora of other subtleties, but I’ve always had the same question as you and thought I’d share.
• zombot 2mo ago
  The project is vibe-coded slop and coding LLMs are not famous for using obvious or minimalistic approaches.