[-] cschreib@programming.dev 1 points 1 day ago

Ironically, it is rustup that triggered me with this most recently... https://www.rust-lang.org/tools/install

[-] cschreib@programming.dev 2 points 1 day ago

Thank you for the nuanced answer!

You ask why I feel this is less secure: it seems the lowest possible bar when it comes to controlling what gets installed on your system. The script may or may not give you a choice as to where things get installed. It could refuse to install or silently overwrite stuff if something already exists. If install fails, it may or may not leave data behind, in directories I may or may not know about. It may or may not run a checksum on the downloaded data before installing. Because it's a competely free-form script, there is no standard I can expect. For an application, I would read the documentation to learn more, but these scripts are not normally documented (other than "use this to install"). That uncertainty, to me, is insecure/unsafe.

[-] cschreib@programming.dev 1 points 1 day ago

I do, but some of these scripts are quite complex and hard to parse. When all I would really need to do this myself is a direct download URL and unzip/untar in a folder of my choice, it's a pain.

[-] cschreib@programming.dev 7 points 1 day ago

Indeed, looking at the content of the script before running it is what I do if there is no alternative. But some of these scripts are awfully complex, and manually parsing the odd bash stuff is a pain, when all I want to know is : 1) what URL are you downloading stuff from? 2) where are you going to install the stuff?

As for running the program, I would trust it more than a random deployment script. People usually place more emphasis on testing the former, not so much the latter.

273

curl https://some-url | sh

I see this all over the place nowadays, even in communities that, I would think, should be security conscious. How is that safe? What's stopping the downloaded script from wiping my home directory? If you use this, how can you feel comfortable?

I understand that we have the same problems with the installed application, even if it was downloaded and installed manually. But I feel the bar for making a mistake in a shell script is much lower than in whatever language the main application is written. Don't we have something better than "sh" for this? Something with less power to do harm?

[-] cschreib@programming.dev 3 points 4 months ago

Sounds great! Sadly it doesn't support Deezer, which is what I use to listen to music. I wonder what it would take to enable this.

[-] cschreib@programming.dev 22 points 7 months ago* (last edited 7 months ago)

How I wish CUDA was an open standard. We use it at work, and the tooling is a constant pain. Being almost entirely controlled by NVIDIA, there's no alternative toolset, and that means little pressure to make it better. Clang being able to compile CUDA code is an encouraging first step, meaning we could possibly do without nvcc. Sadly the CMake support for it on Windows has not yet landed. And that still leaves the SDK and runtime entirely in NVIDIA's hands.

What irritates me the most about this SDK is the versioning and compatibility madness. Especially on Windows, where the SDK is very picky about the compiler/STL version, and hence won't allow us to turn on C++20 for CUDA code. I also could never get my head around the backward/forward compatibility between SDK and hardware (let alone drivers).

And the bloat. So many GBs of pre-compiled GPU code for seemingly all possible architectures in the runtime (including cudnn, cublas, etc). I'd be curious about the actual number, but we probably use 1% of this code, yet we have to ship the whole thing, all the time.

If CPU vendors were able to come up with standard architectures, why can't GPU vendors? So much wasted time, effort, energy, bandwidth, because of this.

How do you people manage this?

[-] cschreib@programming.dev 4 points 10 months ago

I don't know what shady shit you're referring to. They do AI, but I don't use any of that. IMO their core strength is the search engine and how it works for you rather than against.

[-] cschreib@programming.dev 4 points 1 year ago

Then it's a problem of the platform, if there's no way to either tag content on a particular topic, which people can filter if they wish, or a place for meta discussions, which people can choose not to visit. I still agree with the OP that simply deleting/forbidding this content isn't a good option.

[-] cschreib@programming.dev 4 points 1 year ago

I hadn't bought a bundle in a long time, maybe I just don't remember it being that bad, but really? Even with the "extra to charity" preset, the charity gets less than Humble themselves? That's kind of gross.

[-] cschreib@programming.dev 3 points 2 years ago* (last edited 2 years ago)
[-] cschreib@programming.dev 2 points 2 years ago

There's no specific AI detection at the moment, as far as I can tell. But it has "listicle" detection. If you ask "best lawn mower", all these "the 5 best lawn mowers of 2023" websites with affiliated Amazon links get pooled into a compact Listicle section, that you can just scroll past and ignore.

[-] cschreib@programming.dev 19 points 2 years ago

That's crazy. Google/DDG bloat from SEO websites had already driven me out a while ago, so I hadn't noticed. I've been using Kagi for a few months now, and I find I can trust my search results again. Being able to permanently downgrade or even block a given website is an awesome feature, I would recommend it just for that.

view more: next ›

cschreib

joined 2 years ago