5 ms·

Seriously when people will stop using that for installation.... "curl -sL https://asciinema.org/install https://asciinema.org/install | sh" Still a cool produ

• reagency 11y ago
  What's wrong with that? It is SSL secured. Once you agree to install software, it had local access with your accounts privileges.
  • DyslexicAtheist 11y ago
    piping random shit into sh is wrong because domains go away, yet installation instructions might be repeated in countless other tutorials. easy to snap up domains and host malware. and SSL has nothing to do with it. packages are not cryptographically signed either and once on the system can easily become root.
    • joefreeman 11y ago
      Would this be better if the pasted command included some checksum which was checked before piping into the `sh`? Can anyone who's better at bash than me give an example of how this could work in a relatively cross-platform way?
      • nitrogen 11y ago
        You would need to have a GPG signature with a well-known public key that is verified before executing the code.
        • joefreeman 11y ago
          Sorry, can you explain why? If the checksum is provided (as part of the sh snippet) by the website with the SSL certificate, isn't that enough reassurance?
          • myhf 11y ago
            If the snippet and the download are on the same site, then whoever controls that site at the moment can provide an accurate checksum of whatever malware they want to host. A signature is an improvement because it can give you some confidence that the current controller is the same as the original controller.
      • itistoday2 11y ago
        > Would this be better if the pasted command included some checksum which was checked before piping into the `sh`? hashpipe does exactly that: https://github.com/jbenet/hashpipe https://github.com/jbenet/hashpipe
    • sebastianavina 11y ago
      If you are doing a terminal video, I'm pretty sure you are smart enough to break down that pipe and first download, and then run it.
      • smacktoward 11y ago
        So why not make that the way the instructions tell you to do it?
        • notduncansmith 11y ago
          Because as other commenters have said, anyone interested in doing that will do it anyways.
          • couchand 11y ago
            But isn't that the behavior we want to encourage everyone to have? Most people will do the default: if the default is wrong, they don't care. If the default is right, they still don't care, but at least they're doing it right.
    • deleted 11y ago
      [deleted]
    • deleted 11y ago
      [deleted]
    • maccard 11y ago
      Once you've installed it you've given local privileges (or even root) to the app, so you're hosed anyway.
      • vezzy-fnord 11y ago
        I think the bigger danger is that since you're instructing a direct pipe-to-sh over the network without regard to exit status, you're running the risk of executing truncated code that could trash your system state.
        • verteu 11y ago
          The author addresses this issue by wrapping the script [1] in {} braces: { # Prevent execution if this script was only partially downloaded # installation code here } # End of wrapping I'm not sure if this is a bulletproof solution. [1] https://asciinema.org/install https://asciinema.org/install
          • sickill 11y ago
            That's correct. In case bash doesn't see closing braces it will error out with "syntax error" and won't execute anything.
      • e12e 11y ago
        It's pretty rare for an app to need root privileges. You typically need root to write to the system dirs (/usr/* /bin etc). And in this particular case, the app has access (by design) to your terminal, so yeah, you need to trust the app a bit. But why would you need to demand all users of your system (even if that's just system users) also trust it? Put it in ~/opt with xstow, and add ~/opt/bin to your path, ~/opt/man to your man-path, ~/opt/include, ~/opt/lib... to the various paths. In this case, it seems like a lot of effort to get a tgz-archive just to download a single executable. I gather it's distributed as an archive in order for the Changelog, Readme and License to be available -- but as it's all downloaded from github anyway, it's hard to see why that really matters (rather than just have -h spit out a link or two). As, if you're using a normal, full-featured web browser, there's no way of knowing if what you select, is what you copy and then paste -- it would probably be better to just link directly to the latest binary release for the various platforms (linux32, linux64, linux-arm, OSX 32bit, OSX 64bit) -- and let the user save the binary somewhere. Limit the "command line instructions" to: go get github.com/asciinema/asciinema rather than fighting idiomatic go practices. If you really want to be clever, why not just use 0install? http://0install.net/ http://0install.net/
    • fragmede 11y ago
      > packages are not cryptographically signed either Eh? Both debs and rpms can be signed with GPG keys.
  • 0x0 11y ago
    You won't be so happy when your https connection drops after "/" as you are piping into /bin/sh: rm -rf /$INSTALLER_TEMP_DIR
    • sickill 11y ago
      See here: https://news.ycombinator.com/item?id=9754681 https://news.ycombinator.com/item?id=9754681
  • strags 11y ago
    We evolved packaging systems for a reason - they provide a standardized way to manage dependencies, provide clean uninstalls, etc... Having a shellscript pooping files arbitrarily into the filesystem is so 90's. Seriously - you pretty much just have to make a .dep and a .rpm and you're covered. Is that so hard?
    • nacs 11y ago
      > you pretty much just have to make a .dep and a .rpm and you're covered Author already did that [1] and has both .deb and .rpm: https://asciinema.org/docs/installation https://asciinema.org/docs/installation
• sysk 11y ago
  When there will be a better alternative.
  • batou 11y ago
    There's no better alternative for a very good reason.
• sickill 11y ago
  This is something I have been fighting with in my head for quite a while. "Piping shit into sh" is not really great way to do it, I fully agree. Let me describe you the situation. At the moment there are native packages for Ubuntu/Debian (ppa) and Fedora/CentOS (in core repo). There's also homebrew package and Arch Linux one (aur). There are 2 nice guys who maintain the first two packages, doing great job, but it always takes time until the packages are ready (we're all doing it in our spare time, and there's process, especially Fedora case, which you can't skip). I maintain Arch Linux one (while not using Arch for more than few years now) but this one's usually ready on the release day. There are no packages for other distros, but we'll never be able to provide ones for all distros (unless we're very popular project with lots of contributors). That's fine. But there are also situations like this: https://bugs.gentoo.org/show_bug.cgi?id=532918 https://bugs.gentoo.org/show_bug.cgi?id=532918 Let's not get into "Go packaging" discussion again, but what you can see in the mentioned Gentoo thread there's always some problem (no vendoring is bad, vendoring is bad). Sure, these guys do this too in their spare time and they don't owe me anything. But when seeing this I'm like "oh boy, packaging is hard, I don't have time for dealing with this". So time (or lack of thereof) is one thing. Next thing is: "apt-get install asciinema" or "brew install asciinema" is awesome because it uses your software package manager and it's a single command. For all other distros (and people wanting new version right now) you can curl/sh which is equally easy. "First download this script, then review it, then run it" is not that hard but most people wouldn't review the script anyway, and those who would are the ones who are doing that now anyway. curl/sh sucks on many fronts but I made sure the script doesn't get executed when partially downloaded and it's not "| sudo sh". I'm thinking about using one of these services which auto-build deb/rpm, they host them as apt/yum repos etc. There are few of them out there so if anyone can point me to any "proven/reliable" one I'd appreciate that. Any suggestions on the topic are welcome!
  • rickr 11y ago
    I added an RPM package to a project that used a Makefile to spin up a docker container which then built various packages via FPM: https://github.com/jordansissel/fpm https://github.com/jordansissel/fpm I didn't use the build system heavily and it may be more overhead than you'd like but I thought it was a pretty neat way of doing things. Repo is here: https://github.com/tutumcloud/tutum-agent https://github.com/tutumcloud/tutum-agent