There’s also MiniStack, which forked from LocalStack after they started breaking developer workflows: https://ministack.org/
Both fakecloud and its website look sloppily vibe-coded, and its “authors” are anonymous. It’s going to take a while for it to earn trust. I’d treat it with suspicion. (Curl-to-shell pipe to install? Ugh.)
Happy living with Moto https://docs.getmoto.org/en/latest/index.html
Agreed with everything up to:
"curl-to-shell pipe to install" - what's the problem here? that's pretty common on linux systems and something the AWS CLI uses.
Or is the problem the fact that this dev is untrusted and is executing a possibly malicious script on your machine?
For a mock server? Surely a versioned, standalone executable, library/package or docker image makes more sense. Integration tests generally need to be portable and running on CI, you don't wanna be shell-piping whatever exists in the moment.
The problem, for me, is that self-running installers can create a mess that's hard to keep track of.
I've run Linux without meaningful package management, as that was kind of the style of the time 30 years ago with Slackware. It can quickly become untenable.
There's no real difference between an uninspected script that gets piped straight from the URL into the shell, or a similarly-uninspected make&&sudo make install routine from a tarball. They can both execute code that does bad things (whether unintentionally or deliberately), and they can both leave a mess that is hard to cleaned up.
I've found that it is better to just avoid going down that road to begin with. Whether distro-specific packages, Docker containers, flatpaks, or whatever: All of these make housekeeping easier.
Running arbitrary code directly in your terminal is very dangerous
If you're about to install an upstream binary with this and you're not reviewing this then it's purely (irrational) vibes to be concerned with the also unreviewed shell script from the same source.
Any code I didn't write is arbitrary code. At some point I'm left to trust someone or run no software at all.
It’s a shell script. You can download and read it before you run it. Piping it directly to the shell is reckless.
I’m not sure how your machine is configured but mine has permission boundaries and security policies that make sure programs are behaving properly. I don’t run everything with my personal user context.
Actually... Server can detect if you are piping or not and serve a modified version for inspection.
But really, there is no reason not to use prebuilt packages for distribution. Curlpiping needs to die.
At first I thought “this sounds like bullshit” but then found https://web.archive.org/web/20230408195648/https://www.idont...
Package distribution is the best solution but why would you download the install script a second time?
So then... Just do that and it's no longer reckless.
If someone wants to be reckless they can be. If someone doesn't, they also have that ability.
I'm worried that this behaviour has to be defended.
curl-to-shell is a terrible installation mechanism because it's not easily reversible and I can't tell if any of the assets are signed, or integrity checked, or not.
> and its “authors” are anonymous.
The blog posts are all attributed to "Lucas Vieira" and the dev group https://faisca.dev that is attributed as the author has 2 other projects. Lucas comes up in LinkedIn and looks like an actual person working in San Francisco.
Re: curl; this seems to work:
faisca.dev is also vibed - perhaps it's a real human using AI to build an online fascade
I don't think it's being questioned that at some point there is human behind this. Though it could always be that spider.
why does it matter that it's a vibe coded website?
Because taste, creativity, and differentiation matter to a human audience. Perhaps not you personally, but to most people. Ask any experienced marketer.
I don't know about your experienced marketers, but mine are all using AI in some way shape or form!
It’s not really a question of whether they’re using it or not (most of them are); it’s a question of whether they’re using it to generate work product intended to be consumed by their customers. Most know better than that. Some might use it for that, too; but you know what they say about half of the population being below average.
> Both fakecloud and its website look sloppily vibe-coded
As if the MiniStack website wasn't also obviously vibe-coded lol.
It probably is, and that’s not great, either.