Admiral Patrick

I’m surprisingly level-headed for being a walking knot of anxiety.

Ask me anything.

I also develop Tesseract UI for Lemmy/Sublinks

Avatar by @[email protected]

  • 6 Posts
  • 16 Comments
Joined 2 years ago
cake
Cake day: June 6th, 2023

help-circle






  • If they expected you to read the install script, they’d tell you to download and run it. It’s presented here for lazy people in a “trust me, bro, nothing could ever go wrong” form.

    • There are SHA256 checksums of each binary file available in each release on Github. You can confirm the binary was not tampered with by comparing a locally computed checksum to the value in the release’s checksums file.

    • Binaries can also be signed (not that signing keys have never leaked, but it’s still one step in the chain of trust)

    • The install script is not hosted on Github. A misconfigured / compromised server can allow a bad actor to tamper with the install script that gets piped directly into your shell. The domain could also lapse and be re-registered by a bad actor to point to a malicious script. Really, there’s lots of things that can go wrong with that.


    1. That’s been the way to acquire software since shortly after the dawn of time. You already know what you’re getting yourself into.
    2. There are SHA256 checksums of each binary file available in each release on Github. You can confirm the binary was not tampered with by comparing a locally computed checksum to the value in the release’s checksums file.
    3. Binaries can also be signed (not that signing keys have never leaked, but it’s still one step in the chain of trust)
    4. The install script is not hosted on Github. A misconfigured / compromised server can allow a bad actor to tamper with the install script that gets piped directly into your shell. The domain could also lapse and be re-registered by a bad actor to point to a malicious script. Really, there’s lots of things that can go wrong with that.

    The point is that it is bad practice to just pipe a script to be directly executed in your shell. Developers should not normalize that bad practice












  • I think it’s more a generational gap in basic computer skills.

    Millennials grew up alongside modern computing (meaning the two matured together). We dealt with everything from BASIC on a C64 to DOS and then through Windows 3 through current. We also grew up alongside Linux. We understand computers (mostly) and the (various) paradigms they use.

    Gen Z is what I refer to as the iPad generation (give or take a few years). Everything’s dumbed down and they never had to learn what a folder is or why you should organize documents into them instead of throwing them all in “Documents” library and just using search. (i.e. throw everything in a junk drawer and rummage through it as needed).

    As with millennials who can’t balance a checkbook or do basic household tasks, I don’t blame Gen Z for not learning; I blame those who didn’t teach them. In this case, tech companies who keep dumbing everything down.

    Edit: “Balance a checkbook” doesn’t have to mean a physical transaction log for old school checks. It just means keeping track of expenditures and deposits so that you know the money in your account is sufficient to cover your purchases. You’d be surprised how many people my age can’t manage that.