5 ms·

I am genuinely curious what it tells you, as "curl https//.. | sh" has long been an enormously popular approach to distribution in the open source world. Homebr

by mik3y 3mo ago

I am genuinely curious what it tells you, as "curl https//.. | sh" has long been an enormously popular approach to distribution in the open source world. Homebrew, to name just one example, advertises a similar method. (pi.sh also documents other install methods, like `npm`, on their homepage) If trust and security is the issue, unfortunately "better" ideas like hashpipe [1] never achieved critical mass [1] https://news.ycombinator.com/item?id=9318286

tovej 3mo ago
What about better ideas like installing from source, or using a package manager? Or even flatpaks.
- mik3y 3mo ago
  The ideas aren't mutually exclusive, and I've never seen an open source project support "curl | sh" without also supporting those methods. Indeed, plenty of these scripts often act as a "what OS and packager do we have" mux. Just look at the source of this one, for example. When you support an open source project at scale and/or with less savvy users, you come to see the benefit of "here, just f'ing slam this into your shell and we'll figure it out" installers. I know I have.
  - ithkuil 3mo ago
    There are many ways of implementing a curl | sh installer, some of them robust, some of them not. However they all look the same to the end user. That's a feature and also a potential source of problems since users cannot tell if that particular application they want to install Is implementing the installer correctly or not. The outcome is that most users just trust that application (possibly because it's popular and trusted) and that's fine but it also trains the public that this installation method is ok and that gives a positive feedback for other applications to also offer their software using that installer pattern until at least one of such packages is implemented very badly or sneakily malicious. If only a curl had a flag where you pass the sha256 of the file and it first checks it against the buffered file before outputting it to stdout. That would singlehandedly resolve this whole kerfuffle. The install instructions will be a slightly longer one liner and that's fine because people copy paste it anyway
- arbll 3mo ago
  From source: creates much more work for the user. Package managers: ecosystem is fragmented, requiring a long list of distro- and package-manager-specific instructions. Many scripts already install through package managers, they simply make the user’s life easier. Flatpaks: These are clearly designed for desktop applications, with CLIs treated as an afterthought. They may be the best long-term hope, but today they are definitely not as convenient or widely available as a simple script. If you care about adoption, `curl | sh` is the only real option today, which is why virtually all project show it as the first option.
  - tovej 3mo ago
    Bullshit. There's plenty of big projects that don't suggest you curl a script right into your shell. If you have curl, you're probably on Linux. Just use the package manager like an adult.
    - arbll 3mo ago
      The "like an adult" is what has and will continue to hold back linux on the desktop. Always gatekeeping less technical users instead of acknowledging adoption and ease of use are critical.
      - pluralmonad 3mo ago
        Is this stance gate keeping users? Isn't a pkg manager installation also a one liner? This seems more like gate keeping lazy distributors.
        arbll 3mo ago
        A lot of those scripts are wrappers around package managers. Creating them is extra work for distributors, but they still do it because package-manager installs are not truly one-liners and offer far less control over the installation experience. Users need to figure out which of the 10+ package managers they should be using, then run several commands. If something fails, the error messages are often cryptic and not easily configurable by the distributor. And that’s before getting into the many rough edges of package managers. Most of them flat-out refuse to handle configuration and leave that part to the end user. Now you also need to document how to edit YAML and restart a systemd service. With an install script this is also solved. For power users, this always looks trivial. In practice it raises the barrier to entry and can meaningfully affect adoption if your product is often used by less technical people.
TacticalCoder 3mo ago
> I am genuinely curious what it tells you, as "curl https//.. | sh" has long been an enormously popular approach to distribution in the open source world. It's plain horrible. You could have, for example, a compromised server serving malware but only one out of every 100 download. The only signature you rely on is TLS. Proper package distribution are using proper signatures schemes, are decentralized, even for some offer reproducible builds (meaning you can rebuild the whole package yourself and verify your build matches), etc. Hashpipe is an attempt at reproducing some of those guarantees. Not unlike container pining using hashes. It at least fixes the "Jack and John installed this already and I know I'm getting the same version as they did". Proper software distribution is signed, reproducible and ideally also uses some proof-of-existence for the hashes. My bet is this: in the face of the countless supply chain attacks, we'll see more and more people getting very serious about security, including the security of software distribution. And curl bash'ing won't be part of it.
- deleted 3mo ago
  [deleted]
NekkoDroid 3mo ago
I really hate the `curl <url> | sh` specifically because if your connection drops at a specifically unlucky point in time you are left with a partially executed script which if you are unlucky enough may just have been executing `rm -r ~/.cache/<pkg>/download` but it stopped at `rm-r ~/`. Is it likely? No. Can it happen? Yea. Just make it `curl -o <file> <url> && sh <file>` and this entire problem is gone.
- cyberax 3mo ago
  Most scripts now put all the code into a shell function and call it in the last line of the script, so this bug can't happen.
  - msdz 3mo ago
    Correct, and/or in addition, most nowadays prepend something like `set -euo pipefail` to the scripts in the line immediately after the shebang which results in stopping on errors, including things such as syntax errors stemming from e.g. incomplete installer transmission over wire. (At least for bash scripts, I’m not sure whether these are POSIX syntax to be frank.)

by mik3y 3mo ago

tovej 3mo ago

What about better ideas like installing from source, or using a package manager? Or even flatpaks.

mik3y 3mo ago
The ideas aren't mutually exclusive, and I've never seen an open source project support "curl | sh" without also supporting those methods. Indeed, plenty of these scripts often act as a "what OS and packager do we have" mux. Just look at the source of this one, for example. When you support an open source project at scale and/or with less savvy users, you come to see the benefit of "here, just f'ing slam this into your shell and we'll figure it out" installers. I know I have.
- ithkuil 3mo ago
  There are many ways of implementing a curl | sh installer, some of them robust, some of them not. However they all look the same to the end user. That's a feature and also a potential source of problems since users cannot tell if that particular application they want to install Is implementing the installer correctly or not. The outcome is that most users just trust that application (possibly because it's popular and trusted) and that's fine but it also trains the public that this installation method is ok and that gives a positive feedback for other applications to also offer their software using that installer pattern until at least one of such packages is implemented very badly or sneakily malicious. If only a curl had a flag where you pass the sha256 of the file and it first checks it against the buffered file before outputting it to stdout. That would singlehandedly resolve this whole kerfuffle. The install instructions will be a slightly longer one liner and that's fine because people copy paste it anyway
arbll 3mo ago
From source: creates much more work for the user. Package managers: ecosystem is fragmented, requiring a long list of distro- and package-manager-specific instructions. Many scripts already install through package managers, they simply make the user’s life easier. Flatpaks: These are clearly designed for desktop applications, with CLIs treated as an afterthought. They may be the best long-term hope, but today they are definitely not as convenient or widely available as a simple script. If you care about adoption, `curl | sh` is the only real option today, which is why virtually all project show it as the first option.
- tovej 3mo ago
  Bullshit. There's plenty of big projects that don't suggest you curl a script right into your shell. If you have curl, you're probably on Linux. Just use the package manager like an adult.
  - arbll 3mo ago
    The "like an adult" is what has and will continue to hold back linux on the desktop. Always gatekeeping less technical users instead of acknowledging adoption and ease of use are critical.
    - pluralmonad 3mo ago
      Is this stance gate keeping users? Isn't a pkg manager installation also a one liner? This seems more like gate keeping lazy distributors.
      - arbll 3mo ago
        A lot of those scripts are wrappers around package managers. Creating them is extra work for distributors, but they still do it because package-manager installs are not truly one-liners and offer far less control over the installation experience. Users need to figure out which of the 10+ package managers they should be using, then run several commands. If something fails, the error messages are often cryptic and not easily configurable by the distributor. And that’s before getting into the many rough edges of package managers. Most of them flat-out refuse to handle configuration and leave that part to the end user. Now you also need to document how to edit YAML and restart a systemd service. With an install script this is also solved. For power users, this always looks trivial. In practice it raises the barrier to entry and can meaningfully affect adoption if your product is often used by less technical people.

TacticalCoder 3mo ago

> I am genuinely curious what it tells you, as "curl https//.. | sh" has long been an enormously popular approach to distribution in the open source world. It's plain horrible. You could have, for example, a compromised server serving malware but only one out of every 100 download. The only signature you rely on is TLS. Proper package distribution are using proper signatures schemes, are decentralized, even for some offer reproducible builds (meaning you can rebuild the whole package yourself and verify your build matches), etc. Hashpipe is an attempt at reproducing some of those guarantees. Not unlike container pining using hashes. It at least fixes the "Jack and John installed this already and I know I'm getting the same version as they did". Proper software distribution is signed, reproducible and ideally also uses some proof-of-existence for the hashes. My bet is this: in the face of the countless supply chain attacks, we'll see more and more people getting very serious about security, including the security of software distribution. And curl bash'ing won't be part of it.

deleted 3mo ago
[deleted]

NekkoDroid 3mo ago

I really hate the `curl <url> | sh` specifically because if your connection drops at a specifically unlucky point in time you are left with a partially executed script which if you are unlucky enough may just have been executing `rm -r ~/.cache/<pkg>/download` but it stopped at `rm-r ~/`. Is it likely? No. Can it happen? Yea. Just make it `curl -o <file> <url> && sh <file>` and this entire problem is gone.

cyberax 3mo ago
Most scripts now put all the code into a shell function and call it in the last line of the script, so this bug can't happen.
- msdz 3mo ago
  Correct, and/or in addition, most nowadays prepend something like `set -euo pipefail` to the scripts in the line immediately after the shebang which results in stopping on errors, including things such as syntax errors stemming from e.g. incomplete installer transmission over wire. (At least for bash scripts, I’m not sure whether these are POSIX syntax to be frank.)