Hacker News Reader

Looks simple and useful. Only worry is that the installation instruction is a curl request piped to mysql with root user...

Thanks for sharing!

View on HN

curl | sh is a very transparent installer. Here's the source. https://raw.github.com/ankane/groupdate.sql/master/mysql.sql

Also, you don't have to use the root user - I'll make that more clear. Thanks for the feedback!

did you access that url with curl to make sure it does no user agent sniffing?

how do you know the script is the same on subsequent requests?

It's an https request to GitHub, which has about a million more subtle ways to own your machine if they really wanted to.

Figuring out how to solve the TOCTOU problem for a small script in a source control repo is should not be difficult for anyone actually qualified to tell if a script is evil or not by looking at it.

You can always `curl`, then `cat | sh` if you don't trust me :)

Reply on news.ycombinator.com