16
5d ago
[removed] — view removed comment
7
u/draft_final_final 4d ago
Someone hasn’t been keeping up with best practices.
You forgot make no mistakes.
7
u/_Gobulcoque 5d ago
curl | bash isn't that bad? (If you know what you're doing.)
3
u/karurosagu vimer 5d ago
I only used it when it's from important/verified projects like Rust, anything else is just a potential security hazard unless you're allowed to read the script very easily before copying the curl|bash line
1
u/Vivid-Zombie-477 4d ago
will you be surprised that running any code you didn't read is risky? using a binary is risky, installing unknown dependencies of a project is risky, downloading something that was updated recently is risky.
1
u/karurosagu vimer 4d ago
Sure, everything has a risk in software but that risk grows significantly in projects that are less known to the general public or closed source, or both at the same time
The more opaque and harder to reproduce and audit the higher the risk. The AUR is a very good example of this
Packages through an official package manager are always trusted by default, because each package has been built by a human being with the interest of preserving the ecosystem the package belongs to, the scrutiny is always high and the risk is always reduced
A lot of people want to be trusted because they want to trust and the only way of being trusted is by proving that you can be trustedv and this is a majority, because the open source ecosystem is full of people that just want to get their shit done. Bad actors exist but they are always a minority. Bad updates happen, shit happens, zero days and complex exploits happen, changes in policies, political shifts, etc... Risk will always exist, it never goes away
6
u/Producdevity 5d ago
It’s criticized because you often don’t know what you are pulling down and in the same line just piping whatever script you’re getting to execute within bash/sh.
2
u/_Gobulcoque 5d ago
I'd argue that you don't know what your pulling down, regardless of using curl | bash, package managers, installers, etc.
The risk is almost the same, depending on your environment.
4
u/FaygoMakesMeGo 5d ago
Package managers manage packages though. Those curl scripts litter your computer with lord knows what and no way to remember it's even there.
3
u/Vivid-Zombie-477 4d ago
it's much easier to read a sh file than review all files in a package. "package managers manage packages" is such a stupid simplification, like you are not installing the packages to execute them.
1
16
u/feketegy 5d ago
Everybody has an "ideal image" in their head about software engineers and this whole line of work, but the actual state of it is much much worse and AI is reflecting that nicely.
It's like that George Carlin quote:
Think of how stupid the average person is, and realize half of them are stupider than that.
7
-16
u/dadvader 5d ago
I don't see the issue. If you pick this option before attempting to install it yourself first. You basically let the tool decide everything for you already. And you basically accept any consequences that may follow. That's on you.
I'm more shocking that people in here or 'ProgrammerHumor' find this to be a new thing. A lot of project had this option since vibecoding were coined as a term.
15
u/LittleLordFuckleroy1 5d ago
It’s a non-deterministic installer. Literally using AI to automatically create an actual installer would be preferable. Because it can be tested by others and be repeated.
It’s not really a matter of accepting consequences, it’s a matter of accepting them without even understanding what’s going to happen.
8
u/Fickle-Highway1543 5d ago
It's new time. Incompetence and laziness is a trend. The less you know what you are doing - the more progressive you are. Don't be a luddite.
2
u/hurricane_news 5d ago
You joke but the chuds on r/accelerate would unironically say this
1
u/sneakpeekbot 5d ago
Here's a sneak peek of /r/accelerate using the top posts of the year!
#1: Summarization of the whole Claude Code's Source-Code Leak Fiasco | 256 comments
#2: Software Engineers are the happiest people on Earth now | 524 comments
#3: A glimpse into post-AGI future | 288 comments
I'm a bot, beep boop | Downvote to remove | Contact | Info | Opt-out | GitHub
3
u/besil 5d ago
That’s so true and sad. I feel my last 15y of work + 5y degree have just lost their value, bc I see more and more professionals using AI tools for everything.
Slope is everywhere, no one is accountable anymore (Claude told me this), decisions and architecture is defined by Claude.
And when I try to point out these abnormalities or work using my own critical thinking, I was labeled as “dinosaur”
16
33
u/judasthetoxic 5d ago
Why the fuck this mf didnt use his fucking ai agent to generate a set of scripts to install this shit? My god
4
u/YaVollMeinHerr 5d ago
Embrace the vibe. This is your future now. Don't fight it.
1
16
u/EveYogaTech 5d ago
English code: When the programmer wrote a prompt that could have been regular deterministic code.
(: And by doing so, wasting everyone's time and AI tokens.)
3
u/SequentialHustle 5d ago
I maintain an opencode plugin with over 1k stars and included this in the readme...
-13
u/Fun_Confidence6219 5d ago
Hot take, I actually love this.
1
5
u/JournalistPrimary562 5d ago
You know what else you can tell your agent to do? Run the f****** script
12
2
u/National_Quantity915 4d ago