zlacker

>>pictur+(OP)
Can someone explain the Home Assistant anecdote regarding JS and curl | sudo sh? Does the author mean Home Assistant isn't secure? Or that there's some issue with the front end of it? Or something else?

Because imo... that is the answer. We have seen so many stupid closed ecosystems of home automation stuff come and go, I dunno why you'd mess with anything else at this point. In fact I just got another email reminder that Google is turning off the old Works with Nest stack. Remember Nest? Yeah...

>>jmuguy+Ey
"just give us root on your system" install scripts like that are a security thing, yes.

I think the issue is more the attitude towards security and system stability that is implied by such installation methods, which is apaprently endemic to the entire "JS ecosystem". That attitude being "who cares about security or stability?"

When It's my system and I don't want to mess with it, just set stuff up and have it run trouble free and do the things I want (and only I want), then I do care about such things and agree that JS has no place other than sacrificial toy boxes that get insulated from "real" computing like they was a modem with its phone number posted at the payphones by the 2600 meetup.

>>h2odra+yA
The idea is that you give it root on a VM or on a docker container.

You don't give it root on your desktop linux system you do all your sensitive stuff on of course. That makes zero sense. Home assistant really runs great even on a cheap raspberry pi if you don't have a VM- or dockerserver.

>>wkat42+TD
The problem then becomes maintaining it - backing up the config, debugging errors, etc. I ran Home Assistant for a while with their docker method on an otherwise stable server. One day it just shit the bed out of the blue. I wasn't going to spend the time digging into its own bespoke Linux userland to figure out how to figure out what was wrong, and I wasn't going to pave over it and spend the time redoing my meager config. In my book, software that is going to be relied upon gets installed through a distro's package manager, and last time I checked Home Assistant's maintainers are actively opposed to that.