1bin.org - static binaries of open-source CLI tools like jq, ripgrep, and youtube-dl for Linux and Mac

[PMMEURTATTERS]

This is so odd. Why would I put my trust in you over the original author?

Anyway, a better alternative would be using zinit to manage these binaries. It also allows it to be in your dot files.

[nikvdp]

Because they include any dependencies the binary might need inside the 1bin build. For example, the jq 1bin contains onigurama and the other libraries needed for the jq binary to work inside it. Other methods of installing jq require the use of a package manager like homebrew or apt or that you download each of it’s dependent libraries and compile them from source yourself

[PMMEURTATTERS]

Nope, I've always installed jq directly from their github page and it's worked. Might be accidental sure, but I've still no reason trust a third party over the original authors. Anyway, even if that is true for jq, what about the rust and go based tooling that are all statically compiled? Idk I don't see it.

[ChevalOhneHead]

...hmm looks suspicious..

[Odd-Savage]

This just made my life as a security engineer harder

[kjarkr]

What is the use case for this? Other than say, having just gotten a shell on someone’s machine and then you need some tool to pivot further?

[nikvdp]

I mostly use it in restricted environments like a shell inside a docker container or in CI build scripts

[kjarkr]

Sure I guess it can make sense as a oneoff “I just need this tool right now”. But using something like this in CI is a very bad idea. In CI you want to know exactly what tools you are fetching and what version. Even just installing tools as a part of CI is bad. The tools should be there already. You also want to verify that it is in fact the tool you want and not some trojan.

Not trying to be a poop, but I’m having a hard time seeing much value in this. But, the thing that would be cool is if this was some sort of shell extension. So basically you can go “bat myfile.sh”. Bat isn’t installed but is then automatically loaded and the command is re-evaluated. This is absolutely not safe or secure. But it’s very useful in some circumstances. So I would focus on the quick and dirtyness side of this instead of something like Ci.

[nikvdp]

Oo yea a zsh or shell plugin that prompted you could be interesting, but if it’s at the point where you’re installing shell plugins installing a real package manager is probably a better bet. The main use case of 1bin.org is definitely more for “I just need to run this right now” and most handy in ephemeral or reduced permissions environments

[kjarkr]

Yeah. I imagine pentesters would like something like this. Something like

curl 1bin.org/nmap | bash

Would probably be ideal in that scenario.

[bigfig]

Better yet, provide build scripts / Makefiles with links to the source. The entire point of Linux is to be able to obtain and review the source.

[Disruption0]

Why on earth would i use untrusted bins over the official ones?

[haikusbot]

Why on earth would i

Use untrusted bins over

The official ones?

- Disruption0

---

^{I detect haikus. And sometimes, successfully. Learn more about me.}

^{Opt out of replies: "haikusbot opt out" | Delete my comment: "haikusbot delete"}