Hacker News Reader

Comment by jaimex2 | Hacker News Reader

Don't run random scripts basically, always check their content. Specially if they require root.

Welp, there goes Rubygems and NPM global modules.

Always wall off your dev/admin machine and all the credentials therein. Sandbox NPM type things using a VM or at least a non-root container.

Neither requires root:

* https://github.com/creationix/nvm

* http://kazhack.org/?post/2014/12/11/npm-install-g-without-su...

* http://kazhack.org/?post/2014/12/12/pip-gem-install-without-...

You can do it without root if you take precautions, but the default is to use root.

Depends on the system. The default on Arch Linux is local gem installs:

    $ cat /etc/gemrc
    # --user-install is used to install to $HOME/.gem/ by default since we want to separate
    #                pacman installed gems and gem installed gems
    gem: --user-install

That's a nice touch and some good work on the part of the package maintainer. Most (Ubuntu, RedHat, etc.) do not, they just expect you to sudo everything.

Reply on news.ycombinator.com