upvote
Agreed with everything up to:

"curl-to-shell pipe to install" - what's the problem here? that's pretty common on linux systems and something the AWS CLI uses.

Or is the problem the fact that this dev is untrusted and is executing a possibly malicious script on your machine?

reply
For a mock server? Surely a versioned, standalone executable, library/package or docker image makes more sense. Integration tests generally need to be portable and running on CI, you don't wanna be shell-piping whatever exists in the moment.
reply
The problem, for me, is that self-running installers can create a mess that's hard to keep track of.

I've run Linux without meaningful package management, as that was kind of the style of the time 30 years ago with Slackware. It can quickly become untenable.

There's no real difference between an uninspected script that gets piped straight from the URL into the shell, or a similarly-uninspected make&&sudo make install routine from a tarball. They can both execute code that does bad things (whether unintentionally or deliberately), and they can both leave a mess that is hard to cleaned up.

I've found that it is better to just avoid going down that road to begin with. Whether distro-specific packages, Docker containers, flatpaks, or whatever: All of these make housekeeping easier.

reply
Running arbitrary code directly in your terminal is very dangerous
reply
Any code I didn't write is arbitrary code. At some point I'm left to trust someone or run no software at all.
reply
It’s a shell script. You can download and read it before you run it. Piping it directly to the shell is reckless.

I’m not sure how your machine is configured but mine has permission boundaries and security policies that make sure programs are behaving properly. I don’t run everything with my personal user context.

reply
Actually... Server can detect if you are piping or not and serve a modified version for inspection.

But really, there is no reason not to use prebuilt packages for distribution. Curlpiping needs to die.

reply
deleted
reply
At first I thought “this sounds like bullshit” but then found https://web.archive.org/web/20230408195648/https://www.idont...
reply
deleted
reply
So then... Just do that and it's no longer reckless.

If someone wants to be reckless they can be. If someone doesn't, they also have that ability.

reply
I'm worried that this behaviour has to be defended.
reply
curl-to-shell is a terrible installation mechanism because it's not easily reversible and I can't tell if any of the assets are signed, or integrity checked, or not.
reply
> and its “authors” are anonymous.

The blog posts are all attributed to "Lucas Vieira" and the dev group https://faisca.dev that is attributed as the author has 2 other projects. Lucas comes up in LinkedIn and looks like an actual person working in San Francisco.

Re: curl; this seems to work:

  cargo install fakecloud
reply
faisca.dev is also vibed - perhaps it's a real human using AI to build an online fascade
reply
I don't think it's being questioned that at some point there is human behind this. Though it could always be that spider.
reply
why does it matter that it's a vibe coded website?
reply
Because taste, creativity, and differentiation matter to a human audience. Perhaps not you personally, but to most people. Ask any experienced marketer.
reply
> Both fakecloud and its website look sloppily vibe-coded

As if the MiniStack website wasn't also obviously vibe-coded lol.

reply