zackp30 · HackerTrans

10 lat temudiscuss

Haven't looked on the top ten sites list yet, but xvideos uses HTML5 on desktop and mobile now.

10 lat temudiscuss

What do you mean by “blocked”? Chrome on Android has never supported any sort of extension, I wouldn’t say that they’re blocking ad-blockers, more there’s just no support for ad-blockers, or extensions for that matter.

zackp30

10 lat temudiscuss

All good points. Thanks!

I agree that all companies should have a signed package repository, instead of tarballs 100%.

I didn't mean to defend ‘curl | bash‘, I just meant to say why ‘curl | bash‘ isn’t as bad as people think (versus tarballs). Package managers definitely are far superior to tarballs, and ‘curl | bash‘.

Another thing I didn’t like is how the OP seemingly dismissed an entire product with the single statement “kthxbai”, but that’s not relevant.

In an ideal world companies (or even small projects) have repositories, in an even more ideal world they were in the distro repositories already.

zackp30

10 lat temudiscuss

No need for the rudeness.

I always get bothered when people bring up the `curl [...] | bash` “argument” (which is usually less of an argument and more of a rude dismissal of a good product).

Sure, the script downloaded with curl should be validated.

Not sure, but I’m pretty sure you don’t validate every tarball you download, and even if you do validate them, you certainly wouldn’t look through each line of code making sure there isn’t a backdoor or something.

Any malicious person could break into a tarball download site, and replace the checksums as well (only way to mitigate that is using a signature that is associated with the tarball maintainer), and even if something like PGP is used, the attacker would be able to replace the instructions to obtain the PGP key with their own generated one, or even remove the signature completely.

This is, of course, the same for curl piped into bash, but my point is that it’s only slightly worse than an unsecured package site (which I’m sure there are many of). The only thing worse about it is that it’s less noticeable when the script has been replaced.

Also, some scripts (such as the rvm installatio script) /require/ PGP to be used for the installation to even start.

In conclusion, please don’t be rude and dismiss an entire product because of a single installation method, which isn’t actually worse than a malicious tarball.

zackp30

10 lat temudiscuss

Not just you, it's doing it for me also.

Probably caused by:

    (function($) {
        $(document).bind('contextmenu dragstart', function(event) {
            var target = event.target || event.srcElement;
            target = $(target);
            if (target.data('ngg-protect') || target.parent('a').data('ngg-protect') || target.attr('id') == 'fancybox-img' || target.attr('id') == 'TB_Image' || target.attr('id') == 'shTopImg' || target.attr('id') == 'lightbox-image' || target.hasClass('highslide-image') || target.parents('.ngg-albumoverview').length == 1 || target.parents('.ngg-pro-album').length == 1 || photocrati_image_protection_global.enabled == '1') {
                event.preventDefault()
            }
        })
    }(jQuery));

It's extremely annoying when sites do this...

comments