Hacker News Reader

Comment by morganvachon | Hacker News Reader

The fact that the entire source code is displayed on the page for all to read seems to have escaped you. You make a valid point in general, but the site in question practically screams the same message. I don't get why you have a problem with this particular project.

View on HN

The fact that most people could look at that code and have no real clue what it actually does seems to have escaped you. This is in any event not the entire source code, as most of the work is done by function calls which most people would not know how to validate.

If the potential user doesn't understand what the script does, they have no business running it in the first place, so it's a moot point.

Actually what is displayed is not necessarily the same as what would be executed if you ran that script. You are viewing one piece of code , you will be executing a different file. In fact, you can view the github code, and see the code displayed is embedded into index.html (with syntax highlighting).

If anyone is at all concerned with their privacy, they should never blindly run a script like that.

Copy the text displayed in the code block on the page, diff it against the fix-macos.py file in the curl link. It is character for character the same code. Why am I the only one not too lazy to do this?

Today it is, tomorrow? A month from now? When the original dev ignores the site, and someone hacks his pw, changes the code, what then?

I cannot seriously listen to anyone who "cares" about privacy, then asks their users to download and execute unknown code.

Is the link in the curl line binary, compiled, non-human-readable code? No? Then your argument has no merit. It's a plaintext python script. Download it, parse it, if it checks out, run it. If it doesn't check out or you don't understand it, don't. It doesn't matter if it's today, a month from now, or a year from now. If the code checks out, and you feel like it will help you, run it. Or don't, and no one will care.

Or are you seriously going to tell me that you feel you can't trust a 75 line script you just fully vetted, but you can trust, say, the Linux kernel, despite the fact that you didn't manually parse the millions of lines of code in it? If that really is your argument, then I can only imagine that you stop on green and go on red out in the real world, because that's pretty damn fucked up.

No, I'm saying exactly what you are saying. Don't pipe to the shell from curl, download it first, then inspect it. Btw, I can trust a linux binary, because I can verify through checksums, posted on the download site and elsewhere that the binary matches what I expect it to be.

As well, OSX won't let me execute unsigned binary code from unknown developers, unless I manually overwrite it.

The pattern of piping a script from curl and executing it, isn't one I'd expect a site that claims to care about people's privacy to champion. This seems to be exactly what you are saying too.

Why didn't the site owner say, 'curl this script', inspect it, here is the md5 of what it should be, then execute it? Why the cuteness of the direct download and execute? That is my critique.

I think he means you should at least read the code on the other end of that URL to make sure it matches what's on the site.

That's just it: It does. Line for line, character for character (even space for space, which is important in Python). I wouldn't say what I did above without having diffed the file against the code displayed first.

I just don't get the mentality here sometimes; someone creates a helpful script, puts the source code on their site for you to read and study, and the first instinct is to assume they have malicious intent before even taking a few minutes to read over it first. Hell, I'm no programmer but I know enough about the basics to follow exactly what the code does. It took me all of five minutes to decide that it flips two switches and nothing more. That the programming gods here can't or won't do that is telling.

I get being paranoid about random scripts, but this one is on display for all to see before running. There is literally nothing hidden, yet you all act as if the author is trying to secretly take over your machines. It would be funny if it wasn't so pathetic.

Plus you should read what's downloaded to your machine before executing it, since there's also no guarantee that what's been served to your browser will be served to your curl.

Please read http://www.djm.org.uk/protect-yourself-from-non-obvious-dang... (https://news.ycombinator.com/item?id=8385213).

Reply on news.ycombinator.com