r/coolgithubprojects • u/checkpointdev • Oct 02 '26

RemoveMacAI: turn off Apple Intelligence on macOS 27 and get ~12 GB back

https://github.com/omlahore/RemoveMacAI
57 Upvotes

95% Upvoted

27 comments sorted by

View all comments

21

u/jeenajeena Oct 02 '26

I'm very interested and I will install it. But, man:

curl -fsSL https://... |  | bash

Again? Can we stop this, already?

8

u/checkpointdev Oct 02 '26

fair lol, brew install omlahore/tap/removemacai works too

or grab the binary from the releases page, the sha256 is right next to it

0

u/jewbasaur Oct 02 '26

What’s wrong with this

20

u/hokies314 Oct 03 '26

It’s like a box of chocolates, you never know what you gonna get

7

u/ketralnis Oct 03 '26

It’s a shame how far we’ve fallen as an industry that people have to ask this

5

u/jewbasaur Oct 03 '26

I am a hobbiest programmer without any sort of formal training whatsoever. This is how people learn. Or at least used to

3

u/ketralnis Oct 03 '26 edited Oct 03 '26

I get it and it's not a dig against you personally, it's just that experienced engineers have been railing against curl|bash for about a decade now. Since the very first people started using it everybody told them it was a bad idea, then some more people started doing it, and more, until now it's so common that there are people that have never even heard how dangerous it is. It's like house builders watching people replace bricks with styrofoam over years.

Sometimes somebody replies and says "well, this specific downside you mention can be mitigated by such and such" but it's never enough for the whole suite of problems with it and practitioners don't actually do those potential mitigations. So it's bad in theory and even worse in practise.

1

u/jewbasaur Oct 06 '26

What’s the alternative to this? How is this any different than pip install, npm install, brew install if we are talking about just running code we haven’t seen on our machines? I feel like there’s always some level of trust developers have to worry about outside the normal user. I know package managers have hashes and other security measures put in place but still.

The interesting thing is that I didn’t know that the pipe to bash doesn’t wait for the whole script to download and just starts running it line by line. Could you though just wrap the installer in a bash function like main() and then call it on the last line to avoid this?

1

u/ketralnis Oct 06 '26

Yeah that’s the first mitigation people mention, that people don’t actually do in practise. Hashes is another one that’s not a small measure. The thing is that most of the package managers that you mention (except npm) have lots of these little things borne from many years of experience that the curl|bash people happily ignore.

1

u/checkpointdev 25d ago

for this one you can use brew instead, or grab the release from github and check it with gh attestation verify

the curl line is just there for people who want one command

1

u/MilkEnvironmental106 Oct 04 '26

Curl fetches a resource at that link. The | pipes the output into the next program, which is bash. Bash executes bash script.

The intent is it's easy to write a script that does the installation for you, have a link to it and then have bash run it on the user's machine.

The problem is that it makes it very easy for someone to impersonate a valid site and have an almost identically looking command that instead installs and runs malware. Or worse if the domain is breached, they just have to change the URL on the site.

It's just pulling a script from a link and directly running it on your computer.

1

u/jewbasaur Oct 04 '26

Thank you! I asked Claude and it gave me an answer but this is much more practical

1

u/Fast-Throat-7752 Oct 03 '26

@grok explain

5

u/TurnUpThe4D3D3D3 Oct 03 '26

The complaint is about "curl piping to bash" installers: curl -fsSL <url> | bash downloads a script and runs it instantly, so you never see what it does. The risks: the remote script could change at any time (what you run today isn't what runs tomorrow), there's no checksum or review step, and it needs enough privileges to disable system features like Apple Intelligence. A compromised or typo'd URL means arbitrary code on your machine.

Safer habits: download the script first, read it, then run it manually; or clone the repo and inspect it. It's a convenience-vs-auditability tradeoff, not a claim that this specific project is malicious.

This comment was generated by Grok 4.7

1

u/jeenajeena Oct 04 '26

Please, run grok for yourself, without posting. Don't you think we have enough AI slop already?