Comment by otterley
8 hours ago
There’s also MiniStack, which forked from LocalStack after they started breaking developer workflows: https://ministack.org/
Both fakecloud and its website look sloppily vibe-coded, and its “authors” are anonymous. It’s going to take a while for it to earn trust. I’d treat it with suspicion. (Curl-to-shell pipe to install? Ugh.)
Agreed with everything up to:
"curl-to-shell pipe to install" - what's the problem here? that's pretty common on linux systems and something the AWS CLI uses.
Or is the problem the fact that this dev is untrusted and is executing a possibly malicious script on your machine?
For a mock server? Surely a versioned, standalone executable, library/package or docker image makes more sense. Integration tests generally need to be portable and running on CI, you don't wanna be shell-piping whatever exists in the moment.
The problem, for me, is that self-running installers can create a mess that's hard to keep track of.
I've run Linux without meaningful package management, as that was kind of the style of the time 30 years ago with Slackware. It can quickly become untenable.
There's no real difference between an uninspected script that gets piped straight from the URL into the shell, or a similarly-uninspected make&&sudo make install routine from a tarball. They can both execute code that does bad things (whether unintentionally or deliberately), and they can both leave a mess that is hard to cleaned up.
I've found that it is better to just avoid going down that road to begin with. Whether distro-specific packages, Docker containers, flatpaks, or whatever: All of these make housekeeping easier.
Running arbitrary code directly in your terminal is very dangerous
Any code I didn't write is arbitrary code. At some point I'm left to trust someone or run no software at all.
6 replies →
I'm worried that this behaviour has to be defended.
curl-to-shell is a terrible installation mechanism because it's not easily reversible and I can't tell if any of the assets are signed, or integrity checked, or not.
> and its “authors” are anonymous.
The blog posts are all attributed to "Lucas Vieira" and the dev group https://faisca.dev that is attributed as the author has 2 other projects. Lucas comes up in LinkedIn and looks like an actual person working in San Francisco.
Re: curl; this seems to work:
faisca.dev is also vibed - perhaps it's a real human using AI to build an online fascade
I don't think it's being questioned that at some point there is human behind this. Though it could always be that spider.
why does it matter that it's a vibe coded website?
1 reply →
> Both fakecloud and its website look sloppily vibe-coded
As if the MiniStack website wasn't also obviously vibe-coded lol.