As someone who is cyber security conscious, I immediately spot the curl-ed script piped to shell, seems to be happening more and more past years in various projects, I am unsure if I like this future :/
I’m ambivalent about this trend because I fully agree with you and it makes me twitchy, but I also don’t know if I’d actually expect a pre/post-install script pulled in by a package manager to be properly vetted on every incremental version bump either.
Idk, maybe I’m missing a key detail but it feels like it’s emphasising a risk that was previously hidden (and, yes, previously a bit better controlled in theory but perhaps not in practice?) rather than creating a particularly large new risk?
Speaking from experience from being a package maintainer for a Linux distro (I am now retired from that)... Yeah you are right in regards of publicly maintained package registries, as in pypi and npm package registries, but its a whole different story when package is inside a linux distro package registry. Linux distro package registry follows more strict guidelines and flows, and even then many things go through the process, but its still way better in terms of security than running a random shell script from the internet.
It makes me think that the developers assume you’re going to sandbox their app in a Docker container, which I’d do if I had the time and patience to sit down and learn Docker… I guess maybe I should, finally.
Although containerization is way more vulnerable than running in a VM, this is still much better approach than running random software directly on host.
See that’s the kind of stuff I need to learn. I’m familiar with spinning up full VMs like in Virtual Box, installing a full operating system and running apps and scripts within that image, but Docker seems like the same concept but… not?
Hey!
A while ago I found this cool site/service that lives in the terminal and has a bunch of fun stuff from chatting to playing daily games, an artboard, and streaming. Its quite fun, and i thought some people from tildes might like it too! Everything lives in the terminal and can be accessed via ssh, however there is a terminal application that adds some additional features like music listening!
PS If you do join, use my invite code!! We can both get some chips to buy drinks and play games lol
ssh invite-hsk8xsbt@late.sh
I used your code because I was curious. Man the amount of work that went into building this is insane!!!
Edit: unless it’s AI. Because the project is 6 months old, it’s easier a lot of time spent coding or a lot of tokens. Either way, there is a lot going on. Thanks for sharing
This is very interesting. As someone that already spends too much time on irc this is probably up my alley. If I end up joining I'll use your invite code.
matejc | 20 hours ago
As someone who is cyber security conscious, I immediately spot the curl-ed script piped to shell, seems to be happening more and more past years in various projects, I am unsure if I like this future :/
Greg | 18 hours ago
I’m ambivalent about this trend because I fully agree with you and it makes me twitchy, but I also don’t know if I’d actually expect a pre/post-install script pulled in by a package manager to be properly vetted on every incremental version bump either.
Idk, maybe I’m missing a key detail but it feels like it’s emphasising a risk that was previously hidden (and, yes, previously a bit better controlled in theory but perhaps not in practice?) rather than creating a particularly large new risk?
matejc | 17 hours ago
Speaking from experience from being a package maintainer for a Linux distro (I am now retired from that)... Yeah you are right in regards of publicly maintained package registries, as in pypi and npm package registries, but its a whole different story when package is inside a linux distro package registry. Linux distro package registry follows more strict guidelines and flows, and even then many things go through the process, but its still way better in terms of security than running a random shell script from the internet.
Narry | 18 hours ago
It makes me think that the developers assume you’re going to sandbox their app in a Docker container, which I’d do if I had the time and patience to sit down and learn Docker… I guess maybe I should, finally.
matejc | 17 hours ago
Although containerization is way more vulnerable than running in a VM, this is still much better approach than running random software directly on host.
Narry | 15 hours ago
See that’s the kind of stuff I need to learn. I’m familiar with spinning up full VMs like in Virtual Box, installing a full operating system and running apps and scripts within that image, but Docker seems like the same concept but… not?
(Edit: installinga -> installing a)
[OP] eggy | a day ago
Hey!
A while ago I found this cool site/service that lives in the terminal and has a bunch of fun stuff from chatting to playing daily games, an artboard, and streaming. Its quite fun, and i thought some people from tildes might like it too! Everything lives in the terminal and can be accessed via ssh, however there is a terminal application that adds some additional features like music listening!
PS If you do join, use my invite code!! We can both get some chips to buy drinks and play games lol
ssh invite-hsk8xsbt@late.sh
preposterous | a day ago
I used your code because I was curious. Man the amount of work that went into building this is insane!!!
Edit: unless it’s AI. Because the project is 6 months old, it’s easier a lot of time spent coding or a lot of tokens. Either way, there is a lot going on. Thanks for sharing
JRandomHacker | a day ago
Claude is the 5th-higest contributor to the repo.
zod000 | a day ago
This is very interesting. As someone that already spends too much time on irc this is probably up my alley. If I end up joining I'll use your invite code.
tomf | 15 hours ago
come idle in #tildes on libera! it’s totally dead right now, but one day i’ll do a proper announcement and it’ll be super active for that day :)
paris | 21 hours ago
Please tag as vibe coded, thank you!
mycketforvirrad | 21 hours ago
Done. 👍