Comment on An Immich LXC came up on community script

ikidd@lemmy.world ⁨1⁩ ⁨month⁩ ago

• Sanguine@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

  Good advice but ime these helper scripts are legit.

  source

  • ikidd@lemmy.world ⁨1⁩ ⁨month⁩ ago

    I’m pretty familiar with TTech’s legacy, I just mention it because if the repos ever got compromised, it could be a shitshow. IDK what security measures the new maintainers use to secure their access or check PRs, but I get nervous when it’s as popular as it is and such a good vector for complicated installations that are hard to check out. I also don’t know the new maintainers from Adam.

    Personally, I’d use the scripts as a guide for DIY.

    source
  • corsicanguppy@lemmy.ca ⁨1⁩ ⁨month⁩ ago

    ime these helper scripts are legit.

    Let’s consider a moment the risk you’re subjecting people to, just with a recommendation based on the value of the things you secure without considering what they need to secure.

    source

    • Sanguine@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

      I’m not subjecting anyone to anything. I acknowledged that this practice is risky, however these scripts are maintained by a community of other nerds just like every other open source project you enjoy. If you’re going to use these proceed with the same caution you would anything else on the internet, but in my experience they are safe.

      source
• ick@infosec.pub ⁨1⁩ ⁨month⁩ ago

  I created a little proof of concept last year to highlight some of the risks stoppip.ing

  source
• corsicanguppy@lemmy.ca ⁨1⁩ ⁨month⁩ ago

  Curl-bash pipes are a security mess.

  Security mess? Red flag. Avoid.

  source