Hacker News new | ask | show | jobs
by iso1631 10 days ago
most of my machines use unnatended-upgrades

Increasingly software is distributed by "curl dodgysite.com/get.sh|sudo bash -", no different to running "install.exe" on windows

Surely Windows Update is a vetted repo as much as arch or debian
3 comments
drnick1 10 days ago
> Increasingly software is distributed by "curl dodgysite.com/get.sh|sudo bash -"

I don't think this is the norm at all. I have seen curl/bash install scripts for tools like Claude Code, but they don't use sudo, and the expectation is that you deploy them in isolated user accounts or containers.

link
iso1631 9 days ago
== Docker ==

Docker provides a convenience script at https://get.docker.com/ to install Docker into development environments non-interactively.

== Homebrew ==

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)"

Paste that in the macOS Terminal, a Linux shell or WSL. The script explains what it will do and then pauses before it does it. Read about other installation options.

== k3s ==

K3s provides an installation script that is a convenient way to install it as a service on systemd or openrc based systems. This script is available at https://get.k3s.io. To install K3s using this method, just run:

These scripts have lines like

> abort "Need sudo access on macOS (e.g. the user ${USER} needs to be an Administrator)!"

> # --- use sudo if we are not already root ---

link
zen928 10 days ago
> the expectation is that you deploy them in isolated user accounts or containers.

Why are you lying right now? This is a norm across the dev tools world for businesses to distribute dodgy curl piped to bash scripts that users install without question, popular examples: homebrew, docker, nvm, bun, deno, k3s. There is zero "expectation" given by any of these install scripts that they are isolated. Can you even find a single source online that suggests doing what you said for you to think its a commonly held expectation?

link
drnick1 8 days ago
> Can you even find a single source online that suggests doing what you said for you to think its a commonly held expectation?

Isn't it common sense? Do you want coding agents to read and possibly upload somewhere the contents of your home directory?

Also, the expectation on Linux is that you install tools like Docker from the distro's repos.

link
preg_match 10 days ago
There is one major difference: those install under your users. I haven’t seen a windows installer that didn’t require admin. Some older Linux apps require sudo. They don’t need to do that anymore, not for a while. We have xdg standards of where to install stuff in a users home directory.
link
vel0city 9 days ago
Tons of Windows apps these days install into user's AppData these days. Its common for installers to ask "Install for everyone or just me".
link
preg_match 9 days ago
The last time I used Windows seriously, which was Windows 10, this was not the case. If that's changed then great. But we need to acknowledge that Windows software install is changing to become more Linux-ified. With package managers and repos out of the box.

Clearly the Linux model is more secure, and Microsoft knows it. It's a good idea for Microsoft to take inspiration here. It's only a matter of time before they do containerization too, ala Flatpak. The biggest hurdle to that is Windows doesn't have native containers and the entire container ecosystem is build around Linux.

If Microsoft wanted my advice, which they don't, I think it would cost less at this point to just make Windows a Linux distro. Wine is already better at running older Windows software than Windows. Just expand Wine a bit, add in acceleration where it doesn't already exist, and boom you're done. Nobody would even notice.

And maybe then Windows on ARM wouldn't suck so much.

link
vel0city 9 days ago
> The last time I used Windows seriously, which was Windows 10, this was not the case.

Apps like Chrome and Spotify have been doing it for almost 20 years, since they made their Windows apps back in 2008. Python updated their installer to install to the user profile in 2015 with version 3.5.0. VSCode started doing it in 2018. Discord did it at launch in 2015. Zoom and Teams and Slack do it and have for a long time. Its been a pretty common pattern for a long time.

> Windows doesn't have native containers

Windows supports Windows containers natively and has supported Windows containers for a decade.

> maybe then Windows on ARM wouldn't suck so much.

Windows on Arm these days really isn't bad. It definitely sucked a lot several years ago with tons of compatibility issues (along the timeframe you said you last used it seriously), but they've made massive improvements since.

link
preg_match 8 days ago
While windows has containers, I’ve never seen them seriously used and realistically nobody is leaving docker or podman. I include podman in that because Red Hat was smart and made podman almost a direct drop in.

I’m very cynical about windows. Mostly because windows is bad in almost every way software can be bad.

link
lostmsu 10 days ago
Nah, install.exe must be signed by a certificate authority or you get 10 prompts, and they do revoke certificates.
link