The pattern of piping an arbitrary script to your shell? This should be an ordinary app bundle to drop into /Applications, or be distributed as an installer.
The readme even says so itself:
> A bad curl | sh, a sketchy npm install, or one of the AI agents now running in your editor with your full permissions.
And then, two paragraphs down, it suggests to do just that to install…
It's not piped to a shell, but to the tar program with specific parameters to directly unpack the tar.
You're still installing the program directly from github of course, instead of a source where hopefully a third party has also looked at it (like a package repository). But this is a lot better than the curl | sh pattern.
You're not downloading from github, but from dl.jitpass.com.
And an executable can do exactly the same as a shell script. The point is that whatever you're executing isn't verified, whether it's a shell script or a binary.
Is there McAfee for Mac? There's no real difference. You're trusting someone not to root your shit. Whether it's via curl, dmg, or apt, we have no idea who anybody really is, so it's all on an assumption that people aren't evil. Unfortunately it turns out that there are evil people out there, but doing it via curl | bash or downloading a dmg or though some app store, there's still evil that's gonna get you if you end up trusting in the wrong people.
But it’s not piping a script into the shell. It’s curl downloading a compressed archive and piping it to tar to decompress the program binary from the archive. Then moving the extracted binary into /usr/local/bin.
It mostly hurts people in countries with weak purchasing power. DS was the main game in down for them.
Personally, I don't think we've seen the total end of dirt cheap LLMs, it's just a frontier lab doesn't want to be in business of serving half the world.
Thank you for bringing that up, such a rarity for this place to remember the other 80% of the world.
As someone from just such a country, DeepSeek 0731 was the first time I seriously started using an LLM for coding. All previous attempts were useless or ridiculously expensive.
Can't say the old prices felt "free", but it was affordable if you're careful with your cache hit rate.
The new pricing probably pushed it into the unaffordable territory for tasks where you can do without it. Probably will try opencode go if they don't also follow suite, or will have to go back to wetware.
There's a lot more competition over smaller models. Ferraris are frontier labs' main differentiating point when Hondas are increasingly open source and commoditized.
Package management provides cryptographic attestation over the entire process, including the scripts run. Nothing is arbitrary nor mutable in the default state. The files touched will be in a predictable place and the scope of privilege escalation is clearly defined.
It's more about installation location for me. For these types of projects, I don't even install it. I just clone, build and run from there. I have no idea where the bash script is going to put things.
I mean it's probably not, I just haven't got used to it yet. It's about the same level of security as installing a windows app on win2000 25 years ago and blindly downloading a .exe off the internet and running it to get into the install wizard. But indeed I also kind of blindly trust that whatever I'm getting from the debian trixie officially gpg-signed packages isn't backdoored.
One thing I do not do as a matter of practice is install things with a ridiculous number of recursive npm dependencies.
I do not blindly trust anything, and come to the conclusion that downloading binaries from Debian trixie is a lot more safe. There is a world of difference between "curl | sh" and downloading from a curated package repository maintained by a respected community with well-defined processes.
Im working on an extensible and flexible agentic connectivity platform (MCP, OpenAPI/Swagger, FaaS) with niceties like built-in CodeMode, compression, SIEM integration, access token forwarding, SCIM 2.0, on-demand agentic sandboxes (e.g. LangChains "Deep Agents").
For private use not that useful tbh (although i found the OpenAPI -> MCP mapper useful), but found sales success with organizations with more complex agentic setups.
I agree with parent. OpenRouter might be cheaper list-price, but i have been using 10$ on DS platform since April/May, still have 2$ left. Using OpenRouter i depleted the same dollar-amount in a 1-2 weeks with same usage pattern. No idea why.
Not used it but from perusing forums, consensus is OpenRouter has terrible/broken caching for Deepseek wildly inflating token use. The cache metrics are visible so you can verify for yourself (apparently, it's what others have done).
I started doing it, but I would also try to make it more generic, so you can deploy it as an app in your cluster so you don't need necessary a terminal.
But I'll consider the idea. Thanks a lot for the feedback
When DeepSeek was released, it had an immidiate and significant impact on the US stock-market. Now when its becoming common knowledge that China is almost at parity with US SOTA models with good momentum, why is there no sentiment change on the market?
Because markets in the short term are almost a random walk and making the blanket statement that “Walmart stock is down today because Deepseek” was an easy narrative to repeat for media people who cover the stock market.
In reality the world is a highly complex, chaotic, reflexive system, and saying “the entire market moved today because of 12,000,000 factors that randomly aligned” isn’t satisfying enough for people to follow your media channel so they can monetize your eyeballs.
It was never DeepSeek’s release that dropped the NASDAQ at the time; it was the unknown risks of the early thoughts related to trade wars. Popular financial newspapers can promote anything they want, but these news do not typically drive large investor decisions.
It might be because no interested party is using that piece of news to move market. They have enough with other news to do it. Just a practical matter (or may be something else, who knows!)
Back then people didn't understand how AI was run. It should have probably made Nvidia stock actually go up. I think the other Factor, and I might just be two into AI and most people are normies, the hype around Chinese models we've learned is overblown. United States models are a league above.
there was a significant impact on the market because the market assumed that a strong cheaper model would have a significant impact on the US AI companies' business. That didn't happen.
deepseek drop was based on assumption that we overestimated how much compute and infra is needed to train models. They seem to have claimed that they did it in couple of million or something.
When DeepSeek was released, it had an immidiate and significant impact on the US stock-market. Now when its becoming common knowledge that China is almost at parity with US SOTA models with good momentum, why is there no sentiment change on the market?
I’d imagine partly a belief, right or wrong, that protectionism and regulatory capture will reduce China’s models impacts on the US market. Just like automobiles: the big 3 should be terrified of the likes of BYD, but aren’t.
Yeah, but the default is extreme yap mode. I prefer "in a sentence" or "rows, not paragraphs." "Brutal" sounds like bait from an influencer trying to sell me a $400 course about how 4AM workouts will make me a millionaire.
I don't even know how we got here. This isn't that deeply represented in the training data. Is this what RLHF hath wrought? A new dialect of English based on corporatespeak and influencers, two heavy-hitting bullshitters?
