Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

At least it's https; I've seen sites on HN recently[1] that suggest you run code pulled over plain http, as if that wasn't an even more horrible security risk than just blindly running a script from the Internet.

[1] http://chocolatey.org/



  @powershell -NoProfile -ExecutionPolicy unrestricted -Command "iex ((new-object net.webclient).DownloadString('http://chocolatey.org/install.ps1'))" && SET PATH=%PATH%;%systemdrive%\chocolatey\bin
Goodness, that looks awful.


Heh the least they could do is put that into a batch file to be downloaded and clicked on to run.

Chocolatey is sort of like an alternative apt-get for Windows, except that it doesn't need s sudo command and your password to install software. It uses cinst to install stuff:

cinst firefox

Installs Firefox.

The UAC asks the current user to allow the setup program to run and that is about it. No password needed to install like apt-get has.

Oh yeah if your PC doesn't have Powershell installed you are SOL if you try to use that command to install Chocolatey. Some administrators remove it because it can be used to install software without being known to the user.


Right, because UAC assumes someone who is logged in as an admin is supposed to be. I configure sudo like this on some of my dev machines, easier and I don't care about them (usually just VMs).

Why not just restrict the execution policy? I don't really know PS thta well, but doesn't that stop arbitrary (or any) scripts?


You are revealing the security flaws of Windows. Cancel or Allow?




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: