Hacker News new | ask | show | jobs
by lamby 5309 days ago
The installation and uninstallation scripts are idiotic, dangerous and clearly untested.
2 comments

Would you care to elaborate?
Oh christ, where to even start..

First, it downloads and installs a non-checksummed i686 binary version of mongodb. This is outrageously anti-social and one should be embarrassed for releasing that. Ditto ez_setup and all that crap. This is 2011.

I'm only looking at the Debian script now, but it's littered with other bugs such as not calling update-rc.d for amon (it is called for amond). The suggestion to run "curl uninstall.amon.cx | sh" is particularly unsafe as the script has a Bash shebang and /bin/sh could be anything.

A glance at the rpm script suggests bugs fixed in one have not been copied over - for example, you use pgrep correctly in the debian script but in the rpm script you essentially do [ "$(ps aux | grep -c mongo)" = 1 ] which gives you completely the opposite result to what you want.

The uninstallation scripts are perhaps worse, riddled with typos ("/etc.init.d/amond", "torando", etc.) which demonstrate the code has never once been tested, deleting /usr/bin/mongo* even though you install it to /usr/local/ (and screw anyone who had their own version running), deleting any systemwide versions of jinja, and. It won't even uninstall on Darwin due to "[ "$(uname -s)" != "Darwin" ];". And you call "set +e" (a no-op as it's the default) so that if the site_packages shell expansion fails you try and delete "/jinja2", etc.

I'm going home now. This is just what I see on my first glance but I think I've seen enough, frankly.

Thanks a lot for that.

First, it downloads and installs a non-checksummed i686 binary version of mongodb. This is outrageously anti-social and one should be embarrassed for releasing that. Ditto ez_setup and all that crap. This is 2011.

Amon is language agnostic, so there is enourmous chance, that a person who has 0 python knowledge could use it. By default none of the Linux distributions out there have pip or easy_install, so I thats why I have to install it.

I'm only looking at the Debian script now, but it's littered with other bugs such as not calling update-rc.d for amon (it is called for amond)

That is for reason. Some people, especially on small VPS's prefer to keep their memory usage low, so that's why the web part is running on demand only.

It won't even uninstall on Darwin due to "[ "$(uname -s)" != "Darwin" ];"

It's not running on MacOS at all at the moment, that's still work in progress.

Thanks, that's a lot more helpful for someone deciding whether or not to use the software.
If you can help with advice, I will be more than happy to listen :)
Just skimmed the scripts on my mobile and obviously I cannot claim to know the GP's thoughts, but one thing that stood out was a habit of using rm -rf a lot, sometimes with wildcard arguments or environment variables passed on.

I cannot judge the safety in general, but can you list a single reason for using the -f argument here? I'd bet that this is 'just in case' combined with muscle memory gone bad.

Thanks, I will remove the wildcards and rm -rf where I can. I will add more comments to the scripts, so people can instantly know what exactly is happening when they read through.