curl-tap-sh
Dev tools
shell script safety
SHOW HN2016
60points
12comments
#637of 2,264 in 2016
Top 29%of 2016 by points
How HN took it
DebatedReal support and real criticism
2 positive, 2 neutral or asking, 0 mixed, 3 critical, out of 7 comments about the project. Thread score -0.06.
Execution: 1 for, 1 againstIdea: 0 for, 2 againstDesign: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Simple but nice
From 1 comment
Simple, but nice
tambourine_man on HN
Objections
Storing the whole file in an env variable is wasteful and breaks on null characters
From 2 comments
Why do you create an env variable that contains the whole file in question when the editor returned success? Wouldn't something like: ``` cat "$f"; rm "$f" ``` not involve…
robryk on HNMoreover, dumping the file into a variable doesn't seem to be a good idea if the file were to contain null characters.
0xmohit on HN
Not needed when moreutils vipe already does this
From 2 comments
I don't really see, why I'd install something from some github repository if I can get it from a moreutils package that I like to have installed anyway.
sdx23 on HNI think you're specifically saying that the "vipe" command does this: http://manpages.ubuntu.com/manpages/xenial/en/man1/vipe.1.html moreutils is great. Unfortunately, moreutils…
geofft on HN
Pasting is a different use case from curl piped to sh
From 1 comment
How is it better? Pasting is a totally different use case from `curl | sh`.
tree_of_item on HN
Questions
Does it have the same terminal escape sequence vulnerability as bracketed paste?
From 2 comments
Bracketed paste mode can still be broken by a malicious web-site: https://thejh.net/misc/website-terminal-copy-paste . Does this solution have the same vulnerability?
JadeNB on HNDepends on the terminal emulator you're using, I believe. It (and not zsh) needs to filter out escape sequences.
semi-extrinsic on HN
Alternatives named
zsh safe-paste plugin
From 1 comment
A much better feature is available in zsh, called safe-paste, that does this without the user having to insert "tap" or anything else manually. It relies on something called…
semi-extrinsic on HN
moreutils vipe
From 3 comments
I don't really see, why I'd install something from some github repository if I can get it from a moreutils package that I like to have installed anyway.
sdx23 on HNI think you're specifically saying that the "vipe" command does this: http://manpages.ubuntu.com/manpages/xenial/en/man1/vipe.1.html moreutils is great. Unfortunately, moreutils…
geofft on HNThen don't. `vipe` from `moreutils` is acknowledged in this project's readme. I don't have `moreutils` installed; it's plausible that someone might want just the single package,…
OJFord on HN