Hacker News Reader

Comment by mtrpcic | Hacker News Reader

While fixing spotlight is a good idea (especially if you're opening it a lot in public), please don't blindly execute code without reading it first. While this code isn't malicious, running misc. third party code without reading it first is a bad idea for everyone.

View on HN

Especially when you can do the same thing by going into system preferences. What a click bait title that leads people to run a script.

There's always the danger of this attack, as well: http://thejh.net/misc/website-terminal-copy-paste

Here it’s even worse because you don’t see the content of the script you’re executing.

What do you mean? The content is the majority of the web page... You can copy it from there, or if you're paranoid you can run:

  curl https://fix-macosx.com/fix-macosx.py

Before the suggested:

  curl -o https://fix-macosx.com/fix-macosx.py && /usr/bin/python fix-macosx.py

That said, at this stage just set the correct preferences. I had already done that before seeing this script, it's pretty simple.

...This should just be the instructions:

  1) $ curl -o https://fix-macosx.com/fix-macosx.py
  1a) Review fix-macosx.py
  2) $ /usr/bin/python fix-macosx.py

Running miscellaneous second party code is also becoming increasingly problematic from a privacy standpoint...e.g. Windows 8 and Android [with Google services installed] also want to phone home.

It’s not “fixing” anything. It’s changing a preference people can have different opinions about.

It's the same security model as downloading a binary and running it.

Reply on news.ycombinator.com