upvote
For a mock server? Surely a versioned, standalone executable, library/package or docker image makes more sense. Integration tests generally need to be portable and running on CI, you don't wanna be shell-piping whatever exists in the moment.
reply
The problem, for me, is that self-running installers can create a mess that's hard to keep track of.

I've run Linux without meaningful package management, as that was kind of the style of the time 30 years ago with Slackware. It can quickly become untenable.

There's no real difference between an uninspected script that gets piped straight from the URL into the shell, or a similarly-uninspected make&&sudo make install routine from a tarball. They can both execute code that does bad things (whether unintentionally or deliberately), and they can both leave a mess that is hard to cleaned up.

I've found that it is better to just avoid going down that road to begin with. Whether distro-specific packages, Docker containers, flatpaks, or whatever: All of these make housekeeping easier.

reply
Running arbitrary code directly in your terminal is very dangerous
reply
Any code I didn't write is arbitrary code. At some point I'm left to trust someone or run no software at all.
reply
It’s a shell script. You can download and read it before you run it. Piping it directly to the shell is reckless.

I’m not sure how your machine is configured but mine has permission boundaries and security policies that make sure programs are behaving properly. I don’t run everything with my personal user context.

reply
Actually... Server can detect if you are piping or not and serve a modified version for inspection.

But really, there is no reason not to use prebuilt packages for distribution. Curlpiping needs to die.

reply
deleted
reply
At first I thought “this sounds like bullshit” but then found https://web.archive.org/web/20230408195648/https://www.idont...
reply
deleted
reply
So then... Just do that and it's no longer reckless.

If someone wants to be reckless they can be. If someone doesn't, they also have that ability.

reply
I'm worried that this behaviour has to be defended.
reply
curl-to-shell is a terrible installation mechanism because it's not easily reversible and I can't tell if any of the assets are signed, or integrity checked, or not.
reply