News for hackers. Stuff that matters.
Re:The sad state of sysadmin in the age of containers by legulere on Wednesday April 22, 2015 @11:34AM (#9421157)
There's nothing wrong with curl | sudo bash style setups as long as it's over https and the certificate gets checked.

The advantages are that it's easy and you can make it work on almost all unix-like systems out there.

The only disadvantage is that you have one additional weak point: The server can get contaminated. Before you had to contaminate one of the many developer machines / build machines.

The situation hasn't been better before. Install media always got downloaded without ssl encryption or any certificate checks. This is still the same, but at least you won't get a hacked kernel today if you use secure boot.

Re:The sad state of sysadmin in the age of containers by mbreese on Wednesday April 22, 2015 @12:03PM (#9421376)
No, it's just plain bad.

To pick one example why...

Just because it's easy to run doesn't mean it's easy to support or maintain. Chances are `curl | bash` scripts aren't designed for your particular OS, so it's yet another form of software that you have to learn how to update, as opposed to using the OS-level update mechanism, such as yum, apt, or even brew to some extent. Being a good sysadmin doesn't stop at installing the software. Most of the hard (boring) work is in maintaining systems and keeping them updated and secure. Blind install scripts make this job impossible.

There is a very big difference between installing something on your dev machine to just get it started and deploying something into production. `curl | bash` is okay for setting something up on a dev machine where the only one that needs to use it is you. For productions machines, it's completely inappropriate[1].

[1] This is somewhat mitigated by things like Docker, but I'd still argue that you don't want to have an ephemeral installation method for containers either. You should have fixed versions that are installed by either a package manager or at least a Makefile.

Re:The sad state of sysadmin in the age of containers by wang_li on Wednesday April 22, 2015 @01:08PM (#9421866)
Not to mention that in plenty of environments production systems don't have access to the internet to begin with, so curl/wget | bash is a non-starter.
Re:The sad state of sysadmin in the age of containers by contingencies on Thursday April 23, 2015 @01:26AM (#9425139)
There's nothing wrong with curl | sudo bash style setups as long as it's over https and the certificate gets checked.

Even assuming the URL's publisher is trustworthy (which is a poor assumption to make, ever), you forget SSL / HTTPS is broken, that the NSA has established MITM on the entire internet, that your installation process (which should be both versioned and repeatable) now has zero versioning and all the entropy of the network plus bonus entropy.