[13:32] morning [13:37] morning [14:03] RT @laserllama: New idea: kernel extension that makes it impossible to "curl http://example.com/foo.sh | bash" [14:03] http://goo.gl/E3erYM - Example Domain [14:22] while i understand the reasoning behind hating that pattern, how many people are really going to read an install script before they run it anyways? === mrgoodca1 is now known as mrgoodcat [15:22] mrgoodcat: I think the idea is to force people writing software to have to look beyond the "just curl/shell it" as an acceptable pattern for install [15:23] mrgoodcat: so pushing the work back on the dev vs the user [15:24] just like apt-get won't install a .deb if there are errors, make the people packaging software Do It Right(TM) [15:25] i can just as eaily make an evil deb that does bad things when you install it. [15:25] ok, maybe not JUST as easily, but without much more effort. [15:25] true, we're not saying anything here is protection against bad things [15:25] however, if you have a deb you had to get it from somewhere, by default that's a signed place. [15:25] I actually do skim the scripts before I run a curl | bash [15:26] signed, by me. [15:26] jrwren_: and that would probably not make it through a reasonable review (by eg Debian) [15:26] I can make my own PPA, all the pkgs signed by me and yet when you install that deb the postinst rm -rf / [15:26] its not hard to be malicious. [15:26] greg-g: add-apt-repository ? [15:26] of course, but when we work together and review each other, things get better :) [15:27] well that's the nice thing about launchpad ppas, at the very least they're built on machines isolated and means the code is in LP and more [15:27] greg-g: it won't make it into debian or universe, but EASILY into an alt repo. [15:27] jrwren_: of course, there's ways, I didn't say that debs are fool proof [15:27] Also: I can tell when a .deb package was compromised and generally by who [15:27] jrwren_: you're fighting your own strawman [15:27] a shell script is easier to spoof [15:27] huh? [15:27] strawman? [15:27] can we just agree that curl | sudo bash - is ungood and kill it? [15:27] rick_h_: ++ [15:27] https://en.wikipedia.org/wiki/Straw_man [15:27] without debating on the flaws of other systems? [15:27] http://goo.gl/HJAeOd - Straw man - Wikipedia, the free encyclopedia [15:27] my point is it is the same ungood as trusting a PPA [15:27] and we trust PPAs all the time. [15:28] you might, I don't :) [15:28] but, I did, and only when I trusted the person :) [15:28] greg-g: I did not mean to misrepresent anyones point. [15:28] greg-g: rather, I mean to be saying, YES, AND it is not just curl | bash which is bad, but all these other things too [15:28] I just find the whole curl | bash approach to be an anti-pattern [15:28] you took "Just like apt-get fails on error" == "debs are the epitomy of safe" which wasn't what I was saying [15:28] anyyyyywho [15:28] one that has scarily been adopted by many folks [15:28] notably Rubyists. [15:29] yeah, gems and even pypi are scary to Opsen [15:29] greg-g: Say what you mean :p [15:29] jrwren_: I did :) [15:29] greg-g: ok, then what you said is wrong. [15:29] It's teh same reason we don't automatically open URLs posted in channel in our web browsers. [15:29] * greg-g goes to potty before 3.5 hours of meetings [15:30] whatever dude [15:30] I still think you're missing my point and not admitting it [15:30] cmaloney: what is that web chat thing that does that for you? 37signals. [15:30] greg-g: NO, I REALLY did not understand that you meant "apt-get with only trusted repos" [15:30] you're still just taking it to an extreme which wasn't intended, just as any statement, when taken to an extreme, is wrong. [15:31] * greg-g goes [15:31] greg-g: no, i REALLY did not read into your intent. I'm sorry that I did not. [15:31] I am slow and stupid. I'm sorry for that. [15:37] Now you've gone and pissed off greg-g. :) [15:37] I hope you're happy. :) [15:38] And I haven't used the web chat for 37 signals so if they automatically open any URL that's sent to them then I'd call that a vector. :) [15:38] I believe this is appropriate to your discussion: http://abstrusegoose.com/479 [15:38] http://goo.gl/ITNpc - Abstruse Goose | The Beneficence of Others [15:40] wolfger: I take every breath with the knowledge that it is because someone has not strangled me yet. :) [15:41] I'm no longer pissed off :) [15:41] * greg-g drinks more coffee [15:41] It's not even 9am yet :) [15:42] i just feel bad for being so dumb, but i'm not dumb enough to not feel bad about it. [15:43] jrwren_: sorry man, I should have responded better anyways [15:44] greg-g: No sorry needed. Hope your coffee is delicious. [15:45] .np squeekyhoho [15:45] squeekyhoho's current track - New Millennium Cyanide Christ by Meshuggah on Chaosphere [15:46] Wonder if someone has done a study on programming, odd time signatures, and code quality. [16:12] Hmm. Just had a program check for installed tools, and "umph" wasn't installed. It's also not in the repository. Anybody hear of this before? It seems to be only packaged for Fedora. [16:14] .np squeekyhoho [16:14] squeekyhoho's current track - En Mäktig Här by Finntroll on Ur Jordens Djup [16:14] umph? [16:16] https://code.google.com/p/umph/ [16:16] http://goo.gl/YeklJH - umph - Command line tool for parsing YouTube feeds - Google Project Hosting [16:16] Looks like it hasn't been updated in a while [16:16] I'd be suspect of it still working [16:18] good point [16:18] It was being looked for by "NomNom", which I was running just because I have no recollection of what it is. :-p [16:19] If you're looking to download youtube videos I'd highly recommend youtube-dl [16:19] it works and is updated frequently. [16:21] I think I installed NomNom as a general streamripper. There are several good YouTube-specific alternatives. [16:25] https://www.youtube.com/watch?v=N1vvayRpcEU <- Love this song [16:25] http://goo.gl/FJIJtm - Meshuggah - War - YouTube [16:27] cmaloney: Hmm. I was expecting music, not sounds of actual combat. Silly me. ;-) [16:27] That is music. :) [16:27] Also fucking hard to play on the drums. I think they used a drum machine for that. [16:48] it's hard on the (ear)drums? I agree. :-D [17:59] wow i didnt mean to start an argument and walk away [17:59] my bad [18:02] mrgoodcat: lol. <3 [18:02] mrgoodcat: I brought up a website that you can curl | bash to do it again for you automatically. :) [18:03] :) [18:14] I wrote you an exploit but it was in Javascript. [18:15] so I Web8'ed it. [18:15] (That doesn't even make sense) [18:54] LOL [18:54] nonsensical, but amusing. [23:12] Evening [23:13] party [23:27] http://www.wired.com/2014/09/mit-students-face-aggressive-subpoena-demanding-source-code-bitcoin-mining-tool/ [23:27] http://goo.gl/uTUnRe - MIT Students Battle State's Demand for Their Bitcoin Miner's Source Code | WIRED