zlacker

>>pictur+(OP)
> Javascript plus a "curl | sudo sh" attitude to life equals "yeah no, I am never touching this thing".

I get why there are people that don’t like how some installers do this, but this trope is really turning into the “but I don’t even own a TV” of OSS commentary.

Just use the Docker image if you don’t like it. Or get their appliance which actually supports ongoing development.

>>karlsh+h3
Also, no one’s forcing you to pipe curl into sudo sh. I don’t think a software project listing this as an installation method is that big of a red flag to be honest.

>>bryanc+a4
Why is "sudo" emphasized so heavily, anyway? Running as your ordinary user, that shell script can send someone your session cookies, authenticate with your SSH agent, and really anything that you can do. Sure, maybe not running as root protects the integrity of the OS and prevents some persistent keylogging attacks, but honestly... you don't need a keylogger when you just grab the cookies, or install your own binaries farther up in the path (good old ~/.local/bin/firefox instead of /usr/bin/firefox).

Frankly, being anything other than super paranoid is almost a little reckless.

Also, shit-talking Home Assistant is a pretty weird take. I wouldn't write it in Python configured half in YAML and half in SQLite either, but ... not having to write it myself was the fun part.

>>jrockw+k8
I don't use any of this home automation junk, but this kind of begs the question - why would such an app need root access to your devices in the first place?

>>noduer+va
Shit gets complicated, and being able to dynamite a railroad track through a mountain of nuance is just easier.

"Oh, that path is actually not a temp directory and requires permissions different than the user account?" - sudo

"Oh your firewall blocks my outgoing telemetry data?" - sudo

"Oh your firewall blocks my localhost request but I don't actually realize that's what happens but when I try it with sudo it just works everywhere?" - sudo

There are myriad reasons apps want root access, and almost none of them are good reasons, but that doesn't mean it's not simpler for them to get sudo from a user than it is to get dev eyes addressing (let alone understanding) the nuance.

>>IggleS+qe
Why the hell does telemetry need to allow inbound connections?! Running as root for that reason is even more offensive than what I had figured.

I'm not sure why I'm getting downvotes here... is there some cult of people who love installing apps with root privileges?

>>noduer+4H
I think the downvotes might be because I specifically said outbound connections? Although if you have IoT devices it's not unreasonable that they should be able to initiate conversations with your other devices (that would then need permission to accept inbound connections from your IoT devices).

Or maybe the downvotes are because everything I was saying was conjecture / hypothetical anyway, and you're now asking a more specific question to the general question being answered.

I thought the question was "why do apps that don't need sudo request sudo?" And my answer was "perhaps because it's easier to fix permissions problems by getting permission for everything than it is to get them by understanding why your app is getting blocked by them in the first place." Whether it's inbound or outbound or taking video surreptitiously doesn't really answer the question of "why, if the app doesn't actually need it?"

At any rate, I don't actually know why because I don't ask for permissions that I don't need. I also don't know why you're getting downvotes as I didn't downvote you: this answer, like my previous one, is speculative, as is somewhat inevitable when trying to answer "why" questions that relate to the motivations of others.