Hacker News Reader

Comment by marcrosoft | Hacker News Reader

I wouldn’t trust any tool that claims to have anything to do with security that has a curl pipe to bash install advertised.

View on HN

One of the maintainers here and I second that.

Other options available:

  - deb/rpm packages
  - Vagrant
  - Docker-compose
  - Ansible/Puppet
  - Kubernetes/Helm

https://docs.stackstorm.com/install/index.html

...probably better idea to adveritse docker container, not everyone wants to have half-rotten corpse of python app spreading shit around your system forever (there is never an uninstall...) just to test something.

...or at least one that fucking works

    zzz@hydra:~$ curl -sSL https://stackstorm.com/packages/install.sh | bash -s -- --user=st2admin --password=Ch@ngeMe
    *** Detected Distro is Debian ***
    *** Detected flavor bookworm ***
    Unsupported ubuntu codename bookworm. Please use 16.04 (xenial) or Ubuntu 18.04 (bionic) or Ubuntu 20.04 (focal) as base system!

I've tried to drop the check for distro only to be asked for fucking sudo which is like... WTF ?

    zzz@hydra:/tmp$  ./install.sh --user=st2admin --password=Ch@ngeMe
    *** Detected Distro is Debian ***
    *** Detected flavor bookworm ***
    Downloading deployment script from: https://raw.githubusercontent.com/StackStorm/st2-packages/v3.8/scripts/st2bootstrap-deb.sh...
    Running deployment script for st2 ...
    OS specific script cmd: bash st2bootstrap-deb.sh  --stable   --user=st2admin --password=****
    [sudo] password for zzz:

curl|sh that downloads more curl|sh is also interesting choice.

`curl | sh` "installs" are not a good look on any package, and should be dropped -- you are absolutely right -- there is never an "uninstall" process.

It's supporting a few OS platforms and require a clean server for installation: https://docs.stackstorm.com/install/system_requirements.html

Expect to get MongoDB, RabbitMQ and Redis installed as dependencies.

I wouldn't recommend it as a security tool

Works well for DevOps and SRE operations and like K8s, needs a whole team to run it

I've tried on clean account

It is curl|sh that also requires sudo

Reply on news.ycombinator.com