YHK - yet another hacker news clone

Good message but AI generated text is so grating to read.

there's a homebrew alternative

“You wouldn't run a stranger's code without reading it.” Yes I would. We all do it all the time. macOS itself is closed source, and even if it weren't, there’s way too much code to read.

  program.bin
  install.sh

This isn’t really that much of an issue when we have tls tbh.

Like I get why it’s bad, but also homebrew package installation is a more organized version of this.

Hashes are cool but also in a lot of systems you’re trusting the hash to be provided by the same website you don’t trust the binaries from…

Great initiative. I recently got stung by an advert on reddit for "HBO Max for MacOS, 6 months free" from the official HBO user (don't get me started on how that slipped through). Front and center was a curl | bash copy to clipboard that obfuscated the payload source in base10. I knew better, but I think we've made this kind of thing way too acceptable. Of course it was malware and I realized the instant I pressed enter. Thankfully I didn't give it my password and immediately disconnected from the internet and killed the machine. I'm genuinely concerned these kind of attacks are going to become much more commonplace with AI, plus the ability to inject malicious code in to things that get run by trusted scripted installers.

> If the project publishes a SHA-256 hash, use it. Non-negotiable on production machines.

They're pushing FUD around downloading a file but then suggest that we trust the same chain of complex things to display the right hash value? Integrity != authentication.

I bet this is the guy on the call who has to correct someone who calls them SSL certs.

Excuse me, they are TLS certs.

Thanks Arialdomartini, as I was saying… we need to renew the SSL Certs

What’s your suggested installation method instead? Unless it’s “download and read the source before running it” this is no worse than npm install, or pip install, or clicking “trust” on a git repo in VSCode

> Bash starts before the download finishes ... Drop the connection mid-transfer and you get partial execution: a command like rm -r /usr/share/program can truncate to rm -r /usr. Commands ran, cleanup didn’t.

curl | bash scripts all define a function and then call it on the last line. This is a non issue in the real world.

> The server knows you’re piping — and can lie

This `sleep` based trick is always a cool demo to show freinds yes, but the server can also sneak in malware in a multitude of other ways given you're downloading code and binaries from them.

> You trust DNS, TLS, the CDN, and the origin simultaneously. A compromised CDN or BGP hijack delivers malware silently.

Well yes, that's how the internet works. If TLS of the server is really compromised, then the attacker will replace the checksum as well as the signing key. In real scenarios, you are going to be reading the signing key and checksum from the same domain. [1]

> You can’t reproduce what ran

`| tee inspect.sh | bash`

> Add sudo and it’s game over

Most credentials and important files live in the home directory, root is a red herring. If you're running it on shared server, then well... don't add sudo.

[1] Yes of course there are legitimate usecases for signing software. Common example: linux distros which are mirrored at many domains, but the checksum and signature are hosted on the canonical domain. But if I am curlbashing uv's install.sh from `astral.sh`, then doing signature verification using the public key hosted on the same astral.sh isn't adding much.

Nope. The only people who notice or care about any of this are those who can't accommodate the storage. Outside that, it all just works better now (especially Siri).

I'm sick of juggling disk space on my 1tb laptop AND I don't want an llm attack vector anywhere near my machine, this things getting nuked from orbit or i'm not updating to golden gate, ever.

curl|bash is now standard way to install packages on both macOS and Linux. It’s maddening, but it is now.

Uncomfortable, but true.

GNOME has reached maturity and hasn't changed significantly in years, while Apple is busy destroying macOS.

The want some disk space back.

Personally, my limited experimentation with Apple AI has left me quite liking it.

The contents of the Exportable’Privacy Report’ are interesting to look through

I'd argue that a lot of developers can't determine if an LLM generated command is actually safe or not.

Ah, if only that meant that there'll be less slop in the macOS code itself..

Apple hates developers

With LLMs, everyone's a developer now. Welcome to the mainstream.

It’s not about privacy, it’s about kneecapping competitors, just like when they blocked the advertising ID but exempted themselves from this because “Apple is not a third-party, we’re a second-party”.

Apple is an advertising company and thus inherently untrustworthy.

It's interesting to see more customisation tools appearing for macOS, as just a few years ago I was looking for ways to strip down the OS (CI related), and while such info was widely available in the Windows world, to the point that customised "distros" are available, it was nearly nonexistent for macOS; only the Hackintosh community had some useful articles on how things worked.

Could the rise of LLMs and vibe-coding have motivated people who otherwise wouldn't bother?

Apple was late to the AI party. Usually, that's their strategy - let everyone else innovate, when the ecosystem is mature, steal it and claim it as their own. That worked well for decades. But, the pace of AI is too fast to pull this trick off again, so now they're in panic mode. So they do what every shitty corporate does - shove AI down everyone's throat, whether they want it or not. Which is ironically against their founder's motto - build stuff that people want.

I'm not sure there were enough people looking at finder and thinking "I wish I could talk to an AI to open a file on my desktop which I could've simply double clicked on anyway"

Why would you expect Apple X strategy to be different from Microsoft X strategy?

That doesn't seem to do much in the `curl | bash` setting, given that you're not verifying the attestation in that case. You still need to download it separately and run `gh attestation verify` first.

(Note that the attestation does not appear to cover the shell script either, it only covers the script's final payload. The shell script is also referenced via `main`, so it's mutable even if the underlying payload is properly attested. That's not good!)

If a temporary tool being retired is the reason you switch, then wait until you find out how many LOC are being deleted from the linux kernel this year and next

What makes you call it crapware? The new spotlight search (from Siri) is amazing and super convenient.