Hacker News Reader

Comment by dictum | Hacker News Reader

>wget http://shortfin.io/install.sh && sh install.sh

Isn't it recommended that any project doing one-line installs use HTTPS?

Side-note for the author: the download can be made more elegant that way

    $ curl http://shortfin.io/install.sh | sh

I definitely agree with the HTTPS. For example this is what meteor proposes:

    $ curl https://install.meteor.com | sh

asdfsdfgkjlsdfg!

Streaming your install script directly into computer execution without even giving it a once-over, md5 compare, etc is atrociously insecure.

This seems to be a common complaint but I can't see any reason you can't give it a once over when it's hosted on the web…

That's completely orthogonal to what we're talking about here. If you're already not doing it, you're not doing it any less by being more efficient. And it doesn't really matter if you're running it in a throwaway VM like I do.

    curl https://install.meteor.com  | less

... and especially not if you're suggesting run it as root. You should never run anything as root unless you know what it is. Having it over HTTP vs HTTPS makes things really bad though.

In the same way that it's recommended for any other program, yes.

Reply on news.ycombinator.com