Avenv
Dev tools
virtual environment
SHOW HN2018
20points
18comments
#1,193of 2,155 in 2018
Top 56%of 2018 by points
How HN took it
RoastedHalf or more of the comments are critical
0 positive, 1 neutral or asking, 1 mixed, 8 critical, out of 10 comments about the project. Thread score -0.53.
Execution: 0 for, 4 againstPrivacy: 0 for, 3 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
README is well written
From 1 comment
I'll not use this, because I've had enough of Python and will do my best to not start any new Python programs (also I don't know how is this better than virtualenv), but the…
fiatjaf on HN
Not awful as a first chroot manager attempt
From 1 comment
I'd like to say good things, but there are a few big issues first. It goes to the effort of downloading the sha256 hashes... For a filename. It never actually confirms a download…
shakna on HN
Objections
Binary artifacts committed to git and downloads lack hash verification
From 4 comments
I'd like to say good things, but there are a few big issues first. It goes to the effort of downloading the sha256 hashes... For a filename. It never actually confirms a download…
shakna on HNPlease don't put binary artifacts in git; GitHub offers "releases," which are essentially download buckets attached to git tags, from which one can download tars. To the best of…
mdaniel on HNSeems a bit scary to install it like that
sedeki on HNFrom shifty security practices to binaries in the git repo, nothing about this looks serious.
subway on HN
Binding /tmp and /dev is a container escape risk
From 1 comment
> If I get good feedback, I'll rewrite this in proper python code. I don't mind it being a shell script. So is arch-chroot, which is an amazing little tool. > > I have some…
shakna on HN
Relies on bchroot, a beta tool with unaudited security
From 2 comments
I'd like to say good things, but there are a few big issues first. It goes to the effort of downloading the sha256 hashes... For a filename. It never actually confirms a download…
shakna on HNMost of the common chroot tools? Like arch-chroot? Depending on your own tool is fine, but it does mean you don't have a team of people ensuring that security holes are plugged.…
shakna on HN
Assumes x86_64 and /bin/bash, copies resolv.conf blindly
From 1 comment
I'd like to say good things, but there are a few big issues first. It goes to the effort of downloading the sha256 hashes... For a filename. It never actually confirms a download…
shakna on HN
Linux-only support seen as not serious
From 1 comment
Is this a serious project? > Linux only support > > Tell your employer to stop using Macintosh ... because that doesn’t seem like a sign of a serious project to me...
cipherzero on HN
Requests
Use GitHub releases instead of committing binaries
From 1 comment
Please don't put binary artifacts in git; GitHub offers "releases," which are essentially download buckets attached to git tags, from which one can download tars. To the best of…
mdaniel on HN
Add MD5 or stronger hash verification on install
From 1 comment
Seriously. At least add in an MD5 hash, jeez.
ironmagma on HN
Use tmpfs or ramfs instead of binding host /tmp
From 1 comment
> If I get good feedback, I'll rewrite this in proper python code. I don't mind it being a shell script. So is arch-chroot, which is an amazing little tool. > > I have some…
shakna on HN
Symlink resolv.conf instead of copying it
From 2 comments
I'd like to say good things, but there are a few big issues first. It goes to the effort of downloading the sha256 hashes... For a filename. It never actually confirms a download…
shakna on HN> If I get good feedback, I'll rewrite this in proper python code. I don't mind it being a shell script. So is arch-chroot, which is an amazing little tool. > > I have some…
shakna on HN
Use PATH rather than fixed binary locations
From 1 comment
I'd like to say good things, but there are a few big issues first. It goes to the effort of downloading the sha256 hashes... For a filename. It never actually confirms a download…
shakna on HN
Questions
How is this better than virtualenv?
From 1 comment
I'll not use this, because I've had enough of Python and will do my best to not start any new Python programs (also I don't know how is this better than virtualenv), but the…
fiatjaf on HN
Can you elaborate on the /tmp and /dev binding issues?
From 1 comment
The whole shell script is really just because it's a protoype (=Initial commit). If I get good feedback, I'll rewrite this in proper python code. At least for myself it's already…
ihucos on HN
Does it work with package managers other than xbps?
From 1 comment
It uses xbps! ``` $ venv/bin/xbps-install -Sy libreoffice xorg-fonts # you can imagine that as kind of like a chrooted void linux ``` I wonder how easy this is to do with other…
pietroglyph on HN
Alternatives named
virtualenv
From 1 comment
I'll not use this, because I've had enough of Python and will do my best to not start any new Python programs (also I don't know how is this better than virtualenv), but the…
fiatjaf on HN
arch-chroot
From 2 comments
Most of the common chroot tools? Like arch-chroot? Depending on your own tool is fine, but it does mean you don't have a team of people ensuring that security holes are plugged.…
shakna on HN> If I get good feedback, I'll rewrite this in proper python code. I don't mind it being a shell script. So is arch-chroot, which is an amazing little tool. > > I have some…
shakna on HN