Hacker News Reader

Comment by drnick1 | Hacker News Reader

This looks at lot like Android.

I am not sure how I feel about the curl | sh installation. This seems lile the kind of project which should become part of a Linux distro and thoroughly reviewed before it can be trusted unconditionally.

View on HN

Piping curl to sh is pretty much always a bad practice.

Have there been any notable incidents where mistrusting a curl | sh was the cause? I hear people say not to do it way more than I hear people talking about actual incidents it's caused.

I mean you really don't wanna run this one

    echo -e "HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\nrm /" | nc -l 8080 & curl localhost:8080 | sh

edit: seriously, don't run this, not even if you're curious

it'll just print an error message because / is a directory. There's also a good chance curl starts first and fails to connect to the server that's not running yet.

None. It was always a kind of snobbery against packages too small to be in package managers.

There are reasons curl|sh is a bad way to install things but security isn't one. It's difficult to uninstall, for instance.

One coverage tracker used something like this for recommended CI setup, script was hijacked, users were advised to rotate all credentials available in CI.

I've had a few. Not as security attacks.

More just very badly made install scripts, which (in good faith) destroy some part of my operating system.

Messing up repositories added to package manager, creating dependency conflicts, overwriting config files I used. Even removing full folders - "because it's MINE" syndrome. --dry-run modes that are destructive. A lot of install scripts treat my computer as disposable machine meant for their app only.

Not as bad as giving it your root password which it asks on step 3. Not via sudo or run0, it asks you a password which it saves so it can then use sudo or run0. Uuuh no.

It’s not a good look, but: if you’re installing this, you already trust it with your password, since its UI is the lock screen and the login screen, etc. where you enter your password.

Yeah but I think there's a line between trusting a local app and trusting a remote install script

They also have a fedora copr repo for proper package management if you use fedora.

Yeah, definitely ripped straight from Material Design. That clock widget looks like an exact copy of one from a phone I had.

I assume this project is all vibe-coded?

> I assume this project is all vibe-coded?

You know what happens when you assume, right?

https://github.com/duxlabs-dev/dux-shell?tab=contributing-ov...

Quoting in part from that:

> Using an LLM to help write code is fine. Submitting its output unread is not.

> * You are responsible for every line you submit. You have read it, tested it, and can explain it in review.

> * Say in the PR when a meaningful part of the code was AI generated.

> * Write PR descriptions, issues, and comments yourself. No AI-written or AI-rewritten text. A few plain sentences in your own words beat a page of generated summary. PRs and issues with AI-written text get closed without review.

> ...

> * PRs that read like unreviewed output, with narrating comments, invented APIs, or style that ignores the file they are in, get closed without review.

That looks very clearly non-vibe coded to me. (Also, it's a mature project with 79 releases over the last year and a bit, and 321 contributors.)

As much as I respect the abilities of agentic coding LLMs, I don't think we're yet at the point that you could vibe-code a novel Wayland DE. This is not trivial stuff!

There’s a new vibe coded Wayland shell every week now. It’s actually unfortunate DMS renamed when they did. I saw this and assumed it was just another vibe coded abandonware without realizing what it was.

It isn't really a wayland DE. It's a shell that can be used with niri, hyprland, sway, etc. And is also built on top of quickshell.

> You know what happens when you assume, right?

Judging by the text you quoted, you guess correctly?

> As much as I respect the abilities of agentic coding LLMs, I don't think we're yet at the point that you could vibe-code a novel Wayland DE.

You definitely could. Have you tried?

Glad to be proven wrong. :)

I'm not saying you do this, but I do enjoy complaints about piping cURL to shell when so many people are giving LLMs full access to do whatever they want on their computers.

Sometimes they're the same people such at it is fun seeing the mental gymnastics to draw the line just under one's self.

Reply on news.ycombinator.com