Nate Cull is a user on mastodon.social. You can follow them or interact with them if you have an account anywhere in the fediverse. If you don't, you can sign up here.
Nate Cull @natecull

The Internet Gods, 2018:

Security! Security! SSL everywhere! Mandatory two-factor authentication! Full-device encryption! Hardware on-chip secure enclaves!

The Internet Gods, also 2018:

let's just give Jeff Bezos all our private RAM, and the official Node.js installer is literally curl | sudo bash

· Web · 53 · 54
@natecull It's been more or less "just download this crap from the internet and run whatever code it has" since the beginning of the times, so node.js just made it obvious. (Weren't RPM or deb packages signed? Well, yes, but... you know the story.)

@pony @natecull ::stares in nerd::

It makes a distinct difference. the ability for your computer to automatically verify the source computer of a package is non-trivial compared to curlbash. SSL doesn't cut it.

@pnathan @natecull just how.

curl-bash: I'm getting a script that modifies my system running as root from internet, verified and signed by a certificate stored somewhere on my system.

deb: the same.

@pony @pnathan well, with deb you know you're getting it at least signed by *the actual Debian maintainers*.

With curl | bash you... know it came from one specific server that anyone could've put anything on.

@natecull @pnathan you could argue that, I guess. On the other hand, I suspect the ability of node.js to hold their tls certificate and possibly revoke when compromised it is maybe better than what gpg can do. If a gpg key of a debian developer is compromised, I can't really see a way how to handle it securely without manual intervention in the system. And HTTPS will probably be how you learn to do it :)

@pony apt secure makes sure the file hasn't been modified since it was uploaded. Https just secures bytes in transit. Also there's only one organization to trust unlike the hundreds of certificate authorities

@natecull No true Scotsman... err I mean Internet god would recommend Node.js.

@seanl Indeed. It's a very good thing for all of us that the Web doesn't have anything to do with the Internet, isn't it!!!

@natecull The worlds of "web development" and "computer programming" do seem like entirely separate universes much of the time.

@natecull To be fair, RVM (Ruby's VM manager) made the `curl | bash` approach to installation quite popular back about 7 years ago.

But, this questionable behavior goes back even further, to the Usenet days, when people regularly distributed ".shar" archives. Who here is old enough to remember those? ;)

@vertigo @natecull I remember them, but I have even seen them recently. Ruby's not necessarily the best example of good practice.

@natecull those are different gods. Infosec/eff/fsf vs javascript devs/startups

@alienghic

Like so many other things in this topsy-turvy world, it wraps around.

One point at which they touch is web-based password and 'private' key management, for instance.

@natecull

@alienghic
I think this is a key argument. The Internet Gods come from a complicated polytheistic soup much unlike the one of ancient Greece or Rome.
Factions exist with very strong differences and even though everyone from the outside views it as "just tech", in fact infosec, webdev, backend, devops, fintech, gamedev, etc. are all distinc even though sometimes overlapping factions pushing for optimizing sometime diametrically opposite aspects of tech.
@natecull

@kunev @alienghic

The real question is: who is going to play each of the Internet Gods in the inevitable Netflix series

@natecull so are the gods, companies & organizations or people? Wondered would you cast a smaller newer company as a stand in for an older big one. Today we have purism as apple...

@kunev @alienghic @natecull Then you also get into a whole situation with transgressive deities, like the fox-demon who guards the crossroads of webdev and infosec...

@ewoozi
Most likely with a headache inducing level of details...
The trickster of DNS
The succubus of CSS
The elephant demi-god of text editors and his bickering offsprings
Each language it's own denomination of the overall religion which intersects with all other factions mentioned.
Now I kind of want to find someone with literary skills and push them to write a book on this 😄
@alienghic @natecull

@ritjoe @kunev @ewoozi @alienghic @natecull

You people are really, really trying to make me write #sysadmininferno, aren't you?

Oh, and: dammit, @mulander!

@mulander @ewoozi @mwlucas @ritjoe @alienghic @natecull aw gaaawd, just the #systemd drama in of itself can be a LOTR-scale epic 😄
This is so deep, I'm not sure one mere mortal could comprehend it...

@kunev @mulander @ewoozi @ritjoe @alienghic @natecull

The synopsis is accurate.

Speaking as the author, I must recommend in the strongest possible terms that you NOT read this story.

@mwlucas @mulander @ewoozi @ritjoe @alienghic @natecull I fully understand your terrible act of reverse-psychology... And I must say it is transparent, obvious and feels quite effective!

@kunev @mulander @ewoozi @ritjoe @alienghic @natecull

It's also honest. I will not be held responsible for any damages suffered...

@ewoozi trust me, we have plenty of tricksters and advocates for the devils lurking at the boundaries of infosec and madness.

@natecull node.js is coldfusion for a javascript-based internet!!!!