[guy98238710]

> curl -L "https://replicate.fyi/install-llama-cpp" | bash

Seriously? Pipe script from someone's website directly to bash?

[madars]

That's the recommended way to get Rust nightly too: https://rustup.rs/ But don't look there, there is memory safety somewhere!

[creata]

In rustup's defense, if you're already trusting them enough to run their executables, this isn't that much worse, afaik.

[raccolta]

oh, this again.

[cjbprime]

Either you trust the TLS session to their website to deliver you software you're going to run, or you don't.

[dharmab]

You can clone llama.cpp on GitHub and the models from HuggingFace. No need to trust this unrelated website.

[ehnto]

But is you do trust it, very convenient.

[gattilorenz]

Yes. If you are worried, you can redirect it to file and then sh it. It doesn’t get much easier to inspect than that…

[dopidopHN]

Pretty common. You can inspect the script before piping it.

[Evidlo]

Bad actors can detect if its being piped to bash and send different data. Better to just download the script first if you're concerned.

[dopidopHN]

That what I meant but I had no idea about piping detection at the same time so thanks for pointing that out, nifty.

[selcuka]

How can you detect where someone pipes the output of curl output to?

[pests]

Basically, bash executes the script line by line as it is downloading - pausing the download while that line executes. By sending a sleep() command early in the script you can detect the delay in the next line beind downloaded.

Its a lot more complicated due to TCP buffers and trying to hide output from the user.

Original article below. It is giving me a certificate error though but its available through archives or a cache.

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

[asdfgeoff]

Neat article.

Cached version → http://archive.today/O46rw

[column]

"This Connection is Invalid. SSL certificate expired."

[pests]

Yeah I mentioned that. You have to go through a cache or an archive.

[selcuka]

Amazing, thanks.

[mike_ivanov]

who doesn't love surprises

[alexgartrell]

IMO this is equivalently scary to installing an arbitrary rpm.