Hacker News Reader

Comment by digisign | Hacker News Reader

Beware, that setup.py script is not a setuptools script but builds the other scripts and config on the fly. Install is "wget | sudo python." Then it overclocks the Pi. :-/

I once tried installing timidity and usb keyboard on a RPi but there was too much latency to be useful. Interested in the subject, but seems this could be done in a safer manner.

View on HN

It is made by hobbyists to turn a rpi into a dedicated device, I can understand the brute force methods they employ. It looks like it needs the OCd speed to run the software. A different name that didn't collide with current Python ecosystem scripts wouldn't raise as many concerns.

*edit, inverted meaning of last sentance

Instead of setup.py, it could be called, local_hardware_install.py or somesuch.

Never trust anyone who gives you a command that both downloads and executes any script. That person is either malicious, incompetent or they know the risks and just don’t give a shit

Homebrew for Mac is super popular among developers:

https://brew.sh/

And yeah they should know better. On the other hand, modern programming languages also pull libraries from all over the place without any serious vetting. This is becoming more and more of a problem as several people have demonstrated here:

https://news.ycombinator.com/item?id=30679098

I bet sooner or later this will result in a major wannacry/log4j style international incident and then we'll start doing something about it.

How is this different from any other installer that asks for admin access? At least the wget method gives you an opportunity to look at the install script, which most software installers dont provide

It’s just a short-cut, you can easily examine the script and run it later. Most of the time I’ve seen a fair warning to always do the same.

This is a weird take.

For example: From a security POV it’s not meaningfully different from being given a download link for a binary.

Reply on news.ycombinator.com