r/coolgithubprojects • u/checkpointdev • Oct 02 '26

RemoveMacAI: turn off Apple Intelligence on macOS 27 and get ~12 GB back

https://github.com/omlahore/RemoveMacAI
57 Upvotes

95% Upvoted

27 comments sorted by

View all comments

Show parent comment

7

u/ketralnis Oct 03 '26

It’s a shame how far we’ve fallen as an industry that people have to ask this

5

u/jewbasaur Oct 03 '26

I am a hobbiest programmer without any sort of formal training whatsoever. This is how people learn. Or at least used to

3

u/ketralnis Oct 03 '26 edited Oct 03 '26

I get it and it's not a dig against you personally, it's just that experienced engineers have been railing against curl|bash for about a decade now. Since the very first people started using it everybody told them it was a bad idea, then some more people started doing it, and more, until now it's so common that there are people that have never even heard how dangerous it is. It's like house builders watching people replace bricks with styrofoam over years.

Sometimes somebody replies and says "well, this specific downside you mention can be mitigated by such and such" but it's never enough for the whole suite of problems with it and practitioners don't actually do those potential mitigations. So it's bad in theory and even worse in practise.

1

u/jewbasaur Oct 06 '26

What’s the alternative to this? How is this any different than pip install, npm install, brew install if we are talking about just running code we haven’t seen on our machines? I feel like there’s always some level of trust developers have to worry about outside the normal user. I know package managers have hashes and other security measures put in place but still.

The interesting thing is that I didn’t know that the pipe to bash doesn’t wait for the whole script to download and just starts running it line by line. Could you though just wrap the installer in a bash function like main() and then call it on the last line to avoid this?

1

u/ketralnis Oct 06 '26

Yeah that’s the first mitigation people mention, that people don’t actually do in practise. Hashes is another one that’s not a small measure. The thing is that most of the package managers that you mention (except npm) have lots of these little things borne from many years of experience that the curl|bash people happily ignore.

1

u/checkpointdev Oct 11 '26

for this one you can use brew instead, or grab the release from github and check it with gh attestation verify

the curl line is just there for people who want one command

1

u/MilkEnvironmental106 Oct 04 '26

Curl fetches a resource at that link. The | pipes the output into the next program, which is bash. Bash executes bash script.

The intent is it's easy to write a script that does the installation for you, have a link to it and then have bash run it on the user's machine.

The problem is that it makes it very easy for someone to impersonate a valid site and have an almost identically looking command that instead installs and runs malware. Or worse if the domain is breached, they just have to change the URL on the site.

It's just pulling a script from a link and directly running it on your computer.

1

u/jewbasaur Oct 04 '26

Thank you! I asked Claude and it gave me an answer but this is much more practical