Hacker News Reader

I mean, ignoring the fact that the configure script is often a larger program than the one you're trying to install, it (and make) can do anything to your system and unless you read the contents of each you're just taking it on faith that it isn't downloading and installing hundreds of things.

View on HN

... but if I'm installing curl or jq or similar, I'm quite familiar with the provenance of the project, and of the tarball I'm running a configure script from.

And maybe I need to install one or two dependencies, similarly they should be familiar, or small and comprehensible, and only downloaded and installed with my explicit actions.

(And yeah autoconf generated configure scripts are crazy huge and baroque, and could easily be 1/10 the size for the needed functionality, but compared to "npm install" I'll take it.)

Reply on news.ycombinator.com