Hacker News new | ask | show | jobs
by subway 3133 days ago
I know plenty of folks who've ridden motorcycles helmetless for years without any issue.

It's a collection of script written in a non-idempotent manner, and run in an uncontrolled, undefined environment. The benefit of binary packages is that you have a reasonable idea that the package will consistently build in a well defined environment (the base build chroot for the OS + the defined dependencies in the package). The result is a consistent reproducible binary that means when you run version x.y.z it's the same as version x.y.z that I'm running, and the same as version x.y.z that the package maintainer is running.

When software is "packaged" via install scripts that fetch and build from the internet on the fly with loosely defined versions, you stand a lot of risk of breaking your environment. If you only spend time in toy environments playing games and looking at cat pictures, that's fine.

If you rely on the tools you work with to be stable, perform in a consistent manner, and not accidentally leak information about your environment (you'd be shocked by how many test suites will post your local environment variables out to arbitrary metrics collection points), then pre-build binary packages are a safe and reliable way to operate.

You can have fun letting the wind blow through your hair; I'll keep my helmet on, thanks.

2 comments

https://github.com/folkswithhats/fedy/blob/master/plugins/an...

I made it 10 lines into the very first plugin before hitting a point where the installer script is downloading a file over an insecure connection, and treating it as a list of trusted URLs.

And look where those nefarious links are pointing!! developer.android.com and dl.google.com...

As I said, if you feel safer because you run all those commands manually, it is ok...

You stripped the most important part from links, the thing that the comment you replied to was pointing out.
You are changing your argument... You were originally talking about security and whatever you define as a "clean system" not about stability and robustness and on that regard my point remains valid:

Binary packages are not intrinsically more secure that plain text scripts that you can easily audit.

If you feel safer because you are executing by hand a bunch of commands that can be automated with a script that's ok.

In my case I rather spend that time doing something more productive.

Build integrity is inherently a security issue.
You're replying to the wrong person.