Don’t download this. It’s a curl | bash installer for a binary whose sources appear to just … be the popular FOSS bluez btproxy tool, which it downloads and builds, and whose binaries are checked into the repo. But those binaries could just as easily be malware, and every Linux distribution under the sun has bluez as a first-class package.

Assuming that this repo is well intentioned, this should have been a blog post on how to install bluez for your platform and use its proxy tool, with some shell one liners provided to make that easy. Not a curl | bash installer for something totally opaque, which turns out to be another project’s software basically renamed into this repo.

This is not the way. Also potentially a license or trademark/name issue.

▲

trollbridge 38 minutes ago | parent | next [-]

I’d really like to see an end to curl | sh installers. The harness vendors are all notoriously bad about this. OAI, Grok, Claude - all “recommend” installing this way.

Oh-my-pi recommends installing via bun and I give it points there for not promoting this absolute rubbish.

▲

ivanjermakov an hour ago | parent | prev | next [-]

> But it could just as easily be malware

Everything that can be downloaded could easily be malware. No users verify binaries/compile from line-by-line verified source.

It's always about trust in author and distributor. Curl | bash or AUR or build from source - matters very little.

	▲	zbentley an hour ago \| parent [-]
		There’s a big difference between executing something from your package manager—and bluez is packaged by literally every major distribution—and executing: a random binary from a brand new GitHub repo (which you didn’t build and can be swapped out for something evil any time) …that’s actually a different project’s binary rebuilt and renamed/redistributed (or malware) …as root …on a hypervisor. So yes, > It's always about trust in author and distributor Is totally correct. There are different levels of trust. This repo merits very low trust.

▲

j45 an hour ago | parent | prev [-]

What's valuable is someone figured out and shared one way of doing it, their way, and I don't think it was asserted that it was the best or the only way.

Lots of folks use community scripts, or use them as inspirations to build their own.

	▲	zbentley an hour ago \| parent [-]
		A community script is fine. A community script which redistributes opaque binaries that are actually renamed builds of an unrelated project with an incompatible license via curl \| bash is not. At best it indicates a lack of awareness of package managers’ value and convenience (and probably distributes binaries that only work on the owner’s distro to boot). At worst it encourages dangerous install practices and/or distributes malware. A blog post (“here is how you install bluez and run a couple of systemd units that pipe Bluetooth to your VM”) is both more useful for users whose setup differs from the author, less sketchy license- and malware-wise, and more educational. If you want a prepackaged bash tool that automates that too, go nuts. Just don’t vend other people’s software in curl \| bash binaries in your repo.