Hacker News Reader

Comment by mateo1 | Hacker News Reader

I'm speechless. I never expected running curl could lead to such a security disaster.

`sudo curl | sh` to deploy my awesome service that definitely isn't a bitcoin miner, promise.

To be fair, `sudo curl | sh` is completely different than `sudo curl`.

In one command you pipe the output to `sh` which will run whatever instruction it receives. In another command you just ask for an output from `curl`, doing so should not cause any side effect than the output action itself.

The terminal (or rather terminal emulation) is a mistake, people should stop glorifying it. It has no inherent value, beyond being able to run historical software that was bound to a terminal. Most of all one should stop confusing the terminal and the shell, which remains an interesting concept.

Then where should the shell be run?

on the DOM, of course /s

Acme and Emacs give good examples of how a non-terminal shell session can look like. They also make clear how a good CLI application should behave like.

Hard disagree, it has a lot of value and there's a reason it still exists and lots of tooling is still developed for running in terminals and shells, sometimes as exclusive target.

Problems with untrusted, unknown input from any source affects *all* software that process it, internet browsers, document editors, archive extractors, even just opening a file can do lots of funky stuff depending on the file system.

Yes, and I use terminal emulators too, but I look at it the same way I look at browsers. Sure, there is a lot of useful stuff being made with heavy Javascript dependencies, weird Web frameworks, etc., but this doesn't mean that the technology is good in itself.

a terminal is the bare minimum you get when installing an OS (think Arch). is what gives you the power and speed to shape your workflow exactly the way you want it. running shell inside Emacs is not a bad idea, but you don’t get emacs when you install a new OS. you get a terminal that then lets you install emacs. at that point, you might as will just use the terminal.

I don't get what that has to do with my point. Arch leans into terminal enthusiasm, so it is natural that by default all they offer is a tty to install the distribution. But as most other distributions prove, this is not necessary.

I have no idea what that comment means.

I am saying that terminal emulation is bad?

Reply on news.ycombinator.com