Hacker News Reader

For me personally, the security aspect isn't even the reason I dislike curl | bash installers. There's no standard behaviour for curl|sh, and it re-introduces many problems that were solved by package managers decades ago.

Each time I'm about to run `curl https://install.newhotness.io|sudo sh` I'm left with the following questions:

* Will it work? I'm on Arch Linux. This installer was probably tested on OSX and Ubuntu and deemed "portable". I've seen curl|sudo sh installers trying to apt-get installing dependencies.

* Where does it place files? I've got a ~/.meteor folder that's 784MB. Why would you install software libraries and binaries to $HOME? I now have to tell my backup tool to ignore it when backing up my home partition, great. The FHS was established for a reason, people.

* Correlary to the previous question: How do I uninstall it? Maybe all files were installed to a hidden folder in ~/, maybe there's some stuff in /opt, or /usr/local, or who knows where else. If the installer doesn't implement uninstall functionality itself, I now have to go hunt for the stuff it placed in my filesystem.

I understand the need to be able to distribute your software without having to implement native packaging for OSX/Debian/Ubuntu/Red Hat/Fedora/Arch/...

Docker solved this problem. If you're feeling lazy when it comes to distributing your app, just ship a Docker container and be done with it.

View on HN

* package the software for that distro * sign that package * serve your your own repository containing that package * ask your users to add the repository * ask your users to trust the signature

Docker Inc: "Hey wouldn't it be cool if your users could install the latest stable version of Docker?" Arch Linux maintainers: "Yeah, it would. We'll keep the latest version in the repo and our users can just `sudo pacman -S docker`" Docker Inc: "Cool." Arch Linux users: "Cool."

# This is the script that we install somewhere in your $PATH (as "meteor") # when you run # $ curl https://install.meteor.com/ | sh # It's the only file that we install globally on your system; each user of # Meteor gets their own personal package and tools repository, called the # warehouse (or, for 0.9.0 and newer, the "tropohouse"), in ~/.meteor/. This # means that a user can share packages among multiple apps and automatically # update to new releases without having to have permissions to write them to # anywhere global.