Installer is piping curl into shell
I thought we were past this as a society 😔
this post was submitted on 10 Jul 2024
247 points (100.0% liked)
Linux
1253 readers
49 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
A curl piped into a shell or some unofficial packages from various distros.
At this point I don't get why these projects are not Flatpak-first.
Flatpak is worse for debugging, development, and reproducibility.
Its good for user friendly sandboxing, portability, and convenience.
Is it really worse tho? A single build, against a single runtime, free from distro specificities, packaged by the devs themselves instead of offloading the work on distro maintainers?
load more comments
(2 replies)
Flatpaks are reproducible https://ranfdev.com/blog/flatpak-builds-are-not-reproducible/
load more comments
(2 replies)
Can't we basically call this a remote access trojan?
Security wise it doesn't matter, you run the code they wrote in any case. So either trust them or don't. Where it matters is making a mess on your computer and possibly leaving cruft behind when uninstalling. But packages are in the works, Arch even has it since before linux support was announced officially.
This isn't true because until the PR fixing it goes through it downloads other binaries without user consent.
I think you slipped in the discussion intendations somewhere, this branch of the discussion tree is about the implications of piping curl into bash vs. installing packages
So did fedora and nix
That was my first thought as well, but I will say that uBlue distros had a signing issue preventing updates recently, due to an oversight with how they rotated their image signing keys, and the easiest (maybe only?) solution was to pipe a curl command to sh. Even though uBlue is trustworthy, they still recommended inspecting the script, which was only a few lines of code.
~~In this case, though, I dunno why they don't just package it as a flatpak or appimage or put it up on cargo.~~
Edit: nvm, they have some package manager options.
GPU-accelerated renderer.
There's a reason why GUIs don't render fonts in the GPU.
load more comments
(6 replies)
https://github.com/zed-industries/zed/issues/7054#issuecomment-1916315391
They auto download binaries, even proprietary ones, unsigned and without user interaction.
YEAH security!
So they're doing the equivalent of VSCode(ium)'s extensions, but installing them automatically and not giving you the option to use alternatives?
Blegh.
There ought to be a rule that posts about software releases have to say what it is.
Zed (a high-performance code editor announced in 2022), not to be confused with Xed (a small and lightweight text editor released in 2016)
EDIT: or Yed (a small and simple terminal editor core)
My bad, it's up now
I am BEGGING for any editor other than VSCode to have decent remote development. I want to go open source but everything I've tried (remote-nvim, distant, tramp, vscodium, etc.) just doesn't cut it.
Apparently Lapce has remote development as its core feature. But I only (re?)learned of it today..
How didn't tramp work out for you?
Tramp is awesome :)
Is VSCode not open source?
Vscode is like Chrome
And
VS Codium is like Chromium
It has Microsoft BLObs baked in as part of the build process. VS Codium is the FLOSS distribution of VS code's open source code. Liveshare doesn't appear in the package repo Codium uses (because of the Microsoft BLObs it contains as an extension). For work I manually download the live share extension VSX and load it into vscodium
load more comments
(1 replies)
I can see the beginning of something truly great in this editor. It's going to become better than VS code in a year.
It's already great for some languages like Go and Rust.
VScode is proprietary and slow. If you are using something like that you should use VScodium
I hope that's true, but it will be an uphill battle for them to get people to move. VS Code is already pretty good.
built from the ground up with rust. Why the fuck is that the first and usually only (non-)feature to mention in any project written in rust? Who the fuck cares?
I fucking hate the rust cult.
You seem upset. Blink twice if someone is forcing you to use it.
Just go outside and touch some grass.
load more comments
(2 replies)
Interesting project, how ever it will be hard to compete with existing editors and its plugin eco-systems.
I don't think so. The guys who write the plugins are the cracks and the cracks will use zed.
I still do not understand why Zed makes such a big deal about being GPU accelerated when you'll be hard pressed to find a single text editor nowadays that isn't.
load more comments
(1 replies)
I was so happy about this! Been using it on my work MacBook and have been excited to use it on my main laptop!
I never understood the need
Vscodium but not running in a browser.
If it can’t run in a terminal, what is the point?
load more comments
(2 replies)
It's not you who needs it.
It's for buzzword chasers and cost cutters.
Rust (=> fast and hip)
Shared (=> outsourced)
AI generated (=> robot devs)
Get it?
The Rust hype at least makes sense. The other two are just utter bullshit.
load more comments
(3 replies)
I tried saving to a file that required root and it didn't give any prompt to enter the password. On VSCodium normally if you are trying to write to a file that requires sudo then it prompts you.
Is there a way to save to root files with Zed?
load more comments
(4 replies)
view more: next ›