3 ms·
"Provide an install tarball and provide a checksum of it that we can verify." https://github.com/timothyej/Shortfin https://github.com/timothyej/Shortfin My p
by tlrobinson 13y ago
"Provide an install tarball and provide a checksum of it that we can verify."
https://github.com/timothyej/Shortfin https://github.com/timothyej/Shortfin
My point was the people who are going to blindly run curl/sh commands are also going to blindly download the source tarball and run configure/make/make install, and the people who want to do more verification are certainly free to do so.
- lstamour 13y agoI wonder how much work it would be to modify that one-liner to include an MD5 or SHA1 check? Of course it might then be shell and OS-specific... Unless curl or wget can confirm the sha1? Oh... found it! http://superuser.com/questions/453823/is-there-a-tool-that-automatically-downloads-and-compares-md5sums http://superuser.com/questions/453823/is-there-a-tool-that-a...
- nmat 13y agoWithout HTTPS in the main site that is mostly useless
- lstamour 13y agoTrue. Though for a bit of benefit, if the download was hosted separately from the site, that'd be two things to hack. The downside, of course, is that script updates would require new SHA1s. It would be best, then, to insert version numbers into the installer scripts, and a version check. That way if a new version comes out, the installer could warn about it (y/n), while still verifying the SHA1.
- ebbv 13y agoYes people are going to dumb things. But that doesn't mean you need to encourage and facilitate it. That's my point. If you know better you should be facilitating the proper way to do it, not the worst way.
- tlrobinson 13y agoTeaching people good security practices is a lot more involved than telling them to run 3 commands instead of 1.