News for hackers. Stuff that matters.
Re:Detecting the use of “curl | bash” server side by blacklion on Tuesday December 27, 2022 @09:57AM (#34149189)
I don't understand, why do people throw in trash can one of the strongest Linux features: package management.

Left aside security implications of "curl | bash" installation - what will you do if installation fails and you need to roll-back partial changes to system? How will you update this software? How will you uninstall in the future? How will you track CVEs for it, if your package manager doesn't know about its existence and all periodic scripts of your distro can not check for CVEs? How you will update libraries used by this software, are you sure this will not broke it?

Re:Detecting the use of “curl | bash” server side by bigDinosaur on Tuesday December 27, 2022 @10:06AM (#34149267)
Extreme simplicity. This is the installation equivalent to updating your website by scp-ing in a new index.html.
Re:Detecting the use of “curl | bash” server side by blacklion on Tuesday December 27, 2022 @12:08PM (#34150733)
To be honest, if you site is static-generated (where "generated" includes "typed by you in text editor") this approach hasn't any drawbacks to more complex schemes.

Installing software via running random scripts has a ton of drawbacks to using system package manager.

Re:Detecting the use of “curl | bash” server side by tylergetsay on Tuesday December 27, 2022 @09:58AM (#34149211)
This is what has been pushing Arch Linux and the AUR for me
Re:Detecting the use of “curl | bash” server side by marcosdumay on Tuesday December 27, 2022 @11:48AM (#34150388)
Linux needs an normal-user package manager.
Re:Detecting the use of “curl | bash” server side by londonReed on Tuesday December 27, 2022 @12:09PM (#34150750)
Almost all package managers have a graphical front end. I'm not sure how that's not "Normal user" oriented. Windows even has a "Windows Store" bastardized version of a package manager,
Re:Detecting the use of “curl | bash” server side by marcosdumay on Tuesday December 27, 2022 @04:01PM (#34153729)
One that doesn't require root.

A lot of the use cases of those curl | bash scripts are to support non-standard installation, like with unusual distros and user-only. And unusual distros are kind of an unsolvable thing, because people that want them won't want your package manager.

Re:Detecting the use of “curl | bash” server side by londonReed on Wednesday December 28, 2022 @01:42PM (#34164201)
If a user is running a non-standard installation, I would generally assume that they're competent using a package manager.
Re:Detecting the use of “curl | bash” server side by blacklion on Thursday December 29, 2022 @09:14AM (#34172745)
Typical "curl | bash" script requires root, as it want to write to your /usr/bin, /usr/lib and others. You could trick it with chroot, maybe. And maybe not. But in such case you should to discover all dependencies it needs hard way, as you need to put them in your chroot too.
Re:Detecting the use of “curl | bash” server side by hinkley on Tuesday December 27, 2022 @12:15PM (#34150861)
Linux doesn’t have “a package manager”, the distros each have a different one. Is there a tool that will generate a package for each district from a single input? How about testing them? It’s a bit easier now with docker but it’s good that a number of things have forked off of Debian in that you have at least a prayer of getting that package right and covering a lot of people.
Re:Detecting the use of “curl | bash” server side by blacklion on Thursday December 29, 2022 @09:10AM (#34172708)
Yes, each distro has its own repository with its own package manager.

Author should not package software, distro maintainers should.

Re:Detecting the use of “curl | bash” server side by shepherdjerred on Tuesday December 27, 2022 @12:58PM (#34151467)
> I don't understand, why do people throw in trash can one of the strongest Linux features: package management.

Linux package managers are missing many of the packages I want to use. The packages that they do have are often out of date.

Re:Detecting the use of “curl | bash” server side by blacklion on Thursday December 29, 2022 @09:13AM (#34172729)
Change your distro. Or become packager itself. I don't know much about Linux packaging, to be honest, but I found that packaging software for FreeBSD is not much harder than install it locally. If it builds Ok, it is easy to package. If it has problems with build, it will be hard for you anyway - you need to be developer to fix build for you, no matter will you prepare package or not.
Re:Detecting the use of “curl | bash” server side by shepherdjerred on Thursday December 29, 2022 @05:27PM (#34178927)
> Change your distro.

I ship on-prem software, so I have to test on a certain set of distros using different package managers. Changing distros isn't an option for me.

> Or become packager itself.

While this would technically solve the problem, nobody wants to do this.

Instead I use Homebrew (Linuxbrew) which just works.

Re:Detecting the use of “curl | bash” server side by blacklion on Saturday December 31, 2022 @07:22AM (#34195821)
Isn't Linuxbrew package manager too? :)
Re:Detecting the use of “curl | bash” server side by shepherdjerred on Saturday December 31, 2022 @01:05PM (#34198948)
Hah, yes you're right. Unfortunately it doesn't work on Linux arm64, so I'm kinda screwed there.