Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
The post is specifically about how you can serve a totally different script than the one you inspect. If you use
curlto fetch the script via terminal, the webserver can send a different script to a browser based on the UserAgent.And whether or not you think someone would be mad to do it, it's still a widespread practice. The article mentions that piping curl straight to bash is already standard procedure for Proxmox helper scripts. But don't take anyone's word for it, check it out:
https://community-scripts.github.io/ProxmoxVE/
It's also the recommended method for PiHole:
https://docs.pi-hole.net/main/basic-install/
The reality is a lot of newcomers to Linux won't even understand the risks involved, it's run because that's what they're told or shown to do. That's what I did for pihole many years ago too, I'll admit
Users are blameless, I find the fault with the developers.
Asking users to pipe curl to bash because it's easier for the developer is just the developer being lazy, IMO.
Developers wouldn't get a free pass for taking lazy, insecure shortcuts in programming, I don't know why they should get a free pass on this.
I've been accused of "gate keeping" when I tell people that this is a shitty way to deploy applications and that nobody should do it.