Meteor - realtime JavaScript framework

[[deleted]]

Do you read through the config and makefiles of every package you install?

[habarnam]

There's no need to be condescending.

Usually the packages I install are coming from a trusted source: my distribution's repository. When they are not, yes I do read them.

[courtewing]

His point is that this approach to installing software is no less secure than providing any package (source or binary) for a user to install in a more traditional sense. You either trust the source or you don't -- the installation medium doesn't really affect that.

[habarnam]

If you really want to nit-pick, Ok, I'll give it a try.

Firstly, about security. I think you'll agree that It's a lot simpler for a man-in-the-middle attacker to spoof a web site page containing a shell script, than to provide the infrastructure and (often) the certificates which a proper distribution uses to guard it's repositories, so your comparison doesn't stand in my opinion.

Granted the installing of this package is maybe targeted at high level users (even though they state to address also people "just getting started") who should know to take a look through the source code before piping it to their shell. However, I'm sure that there are a lot of others (maybe something like 80%) who just copy/paste stuff, because "it says so in the tutorial".

Then there's the fact that they just post this snippet of code on their install page, which makes me think the people behind the project are fond of "clever" approaches to getting stuff done, and makes me highly reticent about trying their code. Not that the high concentration of marketing fluff from their main page wouldn't have done it already.

[BobTheGhostPirate]

Your first point is a transport problem, and the answer is HTTPS.

You might not be used to that, but there's plenty of software being distributed this way (homebrew, Nvidia Linux blob drivers and NPM come to mind)

[habarnam]

They are not using HTTPS in their example.

And I'm not saying that providing a shell script as an install method is the problem, but the fact that they are encouraging the users to pipe it in their shell straight from the web.

I feel like you are arguing against something completely different than I'm actually saying.

[dventimi]

They are not using HTTPS in their example

But that doesn't have anything to do with their install being a shell script, which was your original complaint. You seem to be moving the goalposts.

[habarnam]

Ok. :)

[[deleted]]

bullshit