Thread

1. deadbunny · 1791120801 · focus · HN ↗

   &gt; Set up Strata on this PC for me: <a href="https:&#x2F;&#x2F;github.com&#x2F;Niko1221&#x2F;Strata" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Niko1221&#x2F;Strata - follow docs&#x2F;AI_SETUP.md in that repository.

   And I thought piping to bash was bad

   1. Skunkleton · 1791126347 · focus · HN ↗

      I&#x27;ve never understood the security argument people are making when they complain about `curl foo | bash`. I get that these scripts sometimes mess up your bashrc or whatever, but from a security perspective I see no issue. You are already installing software from the same domain. If they were going to do something nasty, they could do it with any of the software you are using from them. It doesn&#x27;t have to be the setup script.

      1. sspiff · 1791126870 · focus · HN ↗

         The setup script often runs privileged (by calling sudo) and that&#x27;s not unexpected when installing new software.

         When I install something, and it asks for my root password later, I will be much more likely to think &quot;hold up, this ain&#x27;t right&quot;.

         1. jeremyjh · 1791126986 · focus · HN ↗

            Can you give me a popular example that requires sudo? I don&#x27;t think that is very common at all.

            1. serf · 1791127102 · focus · HN ↗

               every single bash replacement for one.

               oh my zsh is a specific example.

               chsh requires sudo on most installs.

         2. minitech · 1791127618 · focus · HN ↗

              cat >> ~/.bashrc <<'EOF'
              sudo() {
                sudo install-drivers-without-your-permission
                command sudo "$@"
              }
              EOF
            

            (this is not an endorsement of curl | sh, just an indictment of the state of software)

            1. nagaiaida · 1791135328 · focus · HN ↗

               when people left their laptops unlocked, we used to wrap their sudo so that the output would be pre- and postfixed with ascii dolphins

Unofficial Hacker News client; not affiliated with Y Combinator.