3 ms·

The install procedure, for something that's supposed to be a security product: curl -sL https://dl.jitpass.com/jitpass/jit/releases/latest/download/jitpass

by Animats 2mo ago

The install procedure, for something that's supposed to be a security product: curl -sL https://dl.jitpass.com/jitpass/jit/releases/latest/download/jitpass_darwin_arm64.tar.gz | tar -xz jit sudo mv jit /usr/local/bin/ What could possibly go wrong?

thecopy 2mo ago
What is wrong with it?
- 9dev 2mo ago
  The pattern of piping an arbitrary script to your shell? This should be an ordinary app bundle to drop into /Applications, or be distributed as an installer. The readme even says so itself: > A bad curl | sh, a sketchy npm install, or one of the AI agents now running in your editor with your full permissions. And then, two paragraphs down, it suggests to do just that to install…
  - hackernudes 2mo ago
    Technically this one is piping it to tar? But I agree with the sentiment.
  - kokx 2mo ago
    It's not piped to a shell, but to the tar program with specific parameters to directly unpack the tar. You're still installing the program directly from github of course, instead of a source where hopefully a third party has also looked at it (like a package repository). But this is a lot better than the curl | sh pattern.
    - tgv 2mo ago
      You're not downloading from github, but from dl.jitpass.com. And an executable can do exactly the same as a shell script. The point is that whatever you're executing isn't verified, whether it's a shell script or a binary.
      - QuantumNomad_ 2mo ago
        > The point is that whatever you're executing isn't verified, whether it's a shell script or a binary. The GP said: > This should be an ordinary app bundle to drop into /Applications There is no difference between downloading an app bundle that you drop into /Applications, and curling a binary that you put in /usr/local/bin/
      - ZiiS 2mo ago
        The difference is you have the executable for examination (at least a quick virus scan) before you run it. Certanly not perfect, but what is?
        hnlmorg 2mo ago
        You can still do that with their install instructions ;)
        ZiiS 2mo ago
        That is what I am saying, you are trusting them, but less then `curl | sh`
        hnlmorg 2mo ago
        You’re right. My apologies
        fragmede 2mo ago
        Is there McAfee for Mac? There's no real difference. You're trusting someone not to root your shit. Whether it's via curl, dmg, or apt, we have no idea who anybody really is, so it's all on an assumption that people aren't evil. Unfortunately it turns out that there are evil people out there, but doing it via curl | bash or downloading a dmg or though some app store, there's still evil that's gonna get you if you end up trusting in the wrong people.
        ZiiS 2mo ago
  - QuantumNomad_ 2mo ago
    But it’s not piping a script into the shell. It’s curl downloading a compressed archive and piping it to tar to decompress the program binary from the archive. Then moving the extracted binary into /usr/local/bin.
  - vlaaad 2mo ago
    It's curl | tar, not curl | sh
- deleted 2mo ago
  [deleted]
deleted 2mo ago
[deleted]
bukershok 2mo ago
[dead]
jason1cho 2mo ago
I agree that `curl | tar && mv` is not safer than `curl | sh`.
bukershok 2mo ago
that line just pipes a tar archive into tar to extract the binary, not an executable script to a shell. That said, brew install jitpass/tap/jitpass is the recommended way to install.

by Animats 2mo ago

thecopy 2mo ago

What is wrong with it?

9dev 2mo ago
The pattern of piping an arbitrary script to your shell? This should be an ordinary app bundle to drop into /Applications, or be distributed as an installer. The readme even says so itself: > A bad curl | sh, a sketchy npm install, or one of the AI agents now running in your editor with your full permissions. And then, two paragraphs down, it suggests to do just that to install…
- hackernudes 2mo ago
  Technically this one is piping it to tar? But I agree with the sentiment.
- kokx 2mo ago
  It's not piped to a shell, but to the tar program with specific parameters to directly unpack the tar. You're still installing the program directly from github of course, instead of a source where hopefully a third party has also looked at it (like a package repository). But this is a lot better than the curl | sh pattern.
  - tgv 2mo ago
    You're not downloading from github, but from dl.jitpass.com. And an executable can do exactly the same as a shell script. The point is that whatever you're executing isn't verified, whether it's a shell script or a binary.
    - QuantumNomad_ 2mo ago
      > The point is that whatever you're executing isn't verified, whether it's a shell script or a binary. The GP said: > This should be an ordinary app bundle to drop into /Applications There is no difference between downloading an app bundle that you drop into /Applications, and curling a binary that you put in /usr/local/bin/
    - ZiiS 2mo ago
      The difference is you have the executable for examination (at least a quick virus scan) before you run it. Certanly not perfect, but what is?
      - hnlmorg 2mo ago
        You can still do that with their install instructions ;)
        ZiiS 2mo ago
        That is what I am saying, you are trusting them, but less then `curl | sh`
        hnlmorg 2mo ago
        You’re right. My apologies
      - fragmede 2mo ago
        Is there McAfee for Mac? There's no real difference. You're trusting someone not to root your shit. Whether it's via curl, dmg, or apt, we have no idea who anybody really is, so it's all on an assumption that people aren't evil. Unfortunately it turns out that there are evil people out there, but doing it via curl | bash or downloading a dmg or though some app store, there's still evil that's gonna get you if you end up trusting in the wrong people.
        ZiiS 2mo ago
- QuantumNomad_ 2mo ago
  But it’s not piping a script into the shell. It’s curl downloading a compressed archive and piping it to tar to decompress the program binary from the archive. Then moving the extracted binary into /usr/local/bin.
- vlaaad 2mo ago
  It's curl | tar, not curl | sh
deleted 2mo ago
[deleted]

deleted 2mo ago

[deleted]

bukershok 2mo ago

[dead]

jason1cho 2mo ago

I agree that `curl | tar && mv` is not safer than `curl | sh`.

bukershok 2mo ago

that line just pipes a tar archive into tar to extract the binary, not an executable script to a shell. That said, brew install jitpass/tap/jitpass is the recommended way to install.