I only discovered this recently, and it’s very handy.
Piping scripts directly to bash is a security risk. You can always download the scripts, inspect them and run locally if you so choose.
I only discovered this recently, and it’s very handy.
Piping scripts directly to bash is a security risk. You can always download the scripts, inspect them and run locally if you so choose.
There is no functional difference to piping a script vs running an AUR or other user repository install.
If anything it is easier to self audit the script.
But nobody ever actually audits the stuff they run so…
Eh… I have my own repo that pulls the PVE repo and updates a bunch of things to how I want them to be and then runs a local version of the main page. While I don’t stare at every update they make… There’s likely enough of us out there looking at the scripts that we’d sound some alarms if something off was happening.
Which puts you ahead of the curve. But you are still depending on enough other people to be watching every update and so forth.
I am not saying I am much better. But it is one of those things where anyone considering the selfhosted Fun should REALLY spend some time dealing with software supply chains and the like. Too many people just figure “it is open source so it is safe” or, even in this thread, assume something is more or less safe based upon what app pulls it.
Sure, but my point is that it’s no different to an AUR/user repo. At some point you’re just trusting someone else.
I think the whole “Don’t put bash scripts into a terminal” is too broad. It’s the same risk factor as any blind trust in ANY repository. If you trust the repo then what does it matter if you install the program via repo or bash script. It’s the same. In this specific case though, I trust the repo pretty well. I’ve read well more than half of the lines of code I actually run. When tteck was running it… he was very very sensitive about what was added and I had 100% faith in it. Since the community took it over after his death it seems like we’re still pretty well off… but it’s been growing much faster than I can keep up with.
But none of these issues are any different than installing from AUR.
The rule should just be “don’t run shit from untrusted sources” which could include AUR/repo sources.
I’m a real beginner with this stuff and I read through the install scripts before running them. But it wasn’t for security, I just wanted to see if I could learn some tips since I had already struggled to do it manually.
How do you “undo” whatever that script did?
In the case of these ones you just remove the LXC/VM it created.
Neat. Now you have a snowflake install. How do you upgrade it?
Upgrade what? The LXC/VM you just removed because of a wonky script?
You went on with this for way too long, my guy. We get it, you don’t like the helper scripts.
Did you purposefully misunderstand me? How did you not know that I meant “how do you update the thing you installed with a rando shell script” and not “how do you update something after removing it”?
You go into the LXC’s console and type
update, or use whatever package manager is available in the LXC.I’m pretty sure for most of them you just type
updateand it will update.AUR repo items don’t necessarily clean themselves up properly either. So I’m not sure why you think that’s part of some requirement for the scripts if we’re comparing the 2.
Edit: But in the case of this specific repo… You delete the lxc or vm that you created.
pct stop 505 ; pct destroy 505If it messed up the host, just run the proxmox installer key, easy !