Hacker News Reader

Comment by guy98238710 | Hacker News Reader

> curl -L "https://replicate.fyi/install-llama-cpp" | bash

Seriously? Pipe script from someone's website directly to bash?

That's the recommended way to get Rust nightly too: https://rustup.rs/ But don't look there, there is memory safety somewhere!

In rustup's defense, if you're already trusting them enough to run their executables, this isn't that much worse, afaik.

oh, this again.

Either you trust the TLS session to their website to deliver you software you're going to run, or you don't.

You can clone llama.cpp on GitHub and the models from HuggingFace. No need to trust this unrelated website.

But is you do trust it, very convenient.

Yes. If you are worried, you can redirect it to file and then sh it. It doesn’t get much easier to inspect than that…

Pretty common. You can inspect the script before piping it.

Bad actors can detect if its being piped to bash and send different data. Better to just download the script first if you're concerned.

That what I meant but I had no idea about piping detection at the same time so thanks for pointing that out, nifty.

How can you detect where someone pipes the output of curl output to?

Basically, bash executes the script line by line as it is downloading - pausing the download while that line executes. By sending a sleep() command early in the script you can detect the delay in the next line beind downloaded.

Its a lot more complicated due to TCP buffers and trying to hide output from the user.

Original article below. It is giving me a certificate error though but its available through archives or a cache.

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

Neat article.

Cached version → http://archive.today/O46rw

"This Connection is Invalid. SSL certificate expired."

Yeah I mentioned that. You have to go through a cache or an archive.

Amazing, thanks.

who doesn't love surprises

IMO this is equivalently scary to installing an arbitrary rpm.

Reply on news.ycombinator.com