Papi Picante's Spice Log

curl | sudo bash isn't a security issue (on Linux)

Wed, 30 Jul 2025 12:11:23 +0200

When I want to try out a new tool and its “Getting Started” page kicks off with curl https://thingy.dev/install.sh | sudo bash, I usually turn 360° and walk away¹. It’s not worth it.

But this is not because I’m worried about security. In fact I don’t think there’s any real security issue with the curl | sudo bash here.

To understand why, let’s start by considering what happens if we drop this sudo. Is curl | sudo bash more of a security risk than plain curl | bash? I don’t think so, because there’s no significant security boundary between users on Linux. There are two reasons for this:

Learning an alphabet is easy

Tue, 29 Jul 2025 12:40:54 +0200

I studied Russian at school. People often say, “Wow, Russian, that must be so hard, with the different alphabet and all.” I think this reveals that they’re thinking wrongly about learning a language. I think this wrongness is instructive.

Learning a language is a really, really big deal. But you can memorise the Cyrillic alphabet in an hour’s work. You could probably master it in 10. It’s much harder than using chopsticks but it’s much, much easier than speaking Russian¹.

The YX Problem (Reverse XY Problem)

Sun, 02 Mar 2025 13:28:10 +0100

XY Problem interactions go something like this:

Tess: How do I disable SELinux?

Burt: Don’t disable SELinux. Go and read https://xyproblem.info then ask your ACTUAL question.

Tess: My webserver is crashing with “can’t read /etc/foo.conf: permission denied”

Burt: You need to do chmod a+r /etc/foo.conf.

And yeah, fine, in this case Burt had a point. But what about this one:

Tess: How do I disable SELinux?

Burt: Don’t disable SELinux. Go and read https://xyproblem.info then ask your ACTUAL question.

Meandering nonsense about the YX Problem

Sat, 25 Jan 2025 15:37:25 +0100

Note: There’s now a punchier, less silly and obtuse version of this argument here.

The XY Problem is a name for the phenomenon that people asking for help often “skip ahead” to questions about the solution they envisage, instead of asking questions about their problem.

The classic example goes something like this:

Schlörbert: How can I disable SELinux on my GRUNDUS device?

Æthelred: Don’t do that. Why do you want to do that? That’s insecure.

WENUS Priests

Wed, 07 Feb 2024 19:56:03 +0000

I work for a big tech company. I have a laptop that I carry to work in my bike bag and plug into the screens and keyboard and mouse. I mainly use it to log into a virtual machine in “Western Europe”. I like “my” virtual machine because it has lots of virtual CPUs and virtual RAM, although when it reboots it’s pretty slow for a while. I think this is because its virtual disk dissipates into the ether of a staggeringly complex globally distributed data storage system and has to be reconstituted on-demand.

Some Observations About German

Sat, 06 May 2023 16:28:03 +0000

I’ve been living in Zürich and therefore learning German for the last few years. Here are some things about German that are funny or interesting.

Some things are countable in German that are not in English. This quickly polluted my brain and now I find myself saying things like “can you pick up a bread from the shop” when speaking English.
“Willst du mich verarschen?” means something like “are you fucking with me? Literally “do you want to arse me?”

Papi Picante's 'Mirchi Mama' vegan curries

Fri, 31 Dec 2021 17:36:06 +0000

I wanted to cook for a really large number of people and decided curry was the way to make the most delicious food for the least labour. I doubted my ability to eyeball the amount of spices etc. since I’m used to cooking for 2-4 people max. So I made them in normal portions and measured all the quantities, so that I could scale them up.

All the fresh vegetables are in season in the winter in Europe. All the ingredients that aren’t in mainstream supermarkets can be found in south-Asian speciality shops.

Tax Choices

Thu, 09 Sep 2021 10:00:00 +0000

Today Boris Johnson’s Commons majority voted to break their manifesto promise by increasing National Insurance in England.

National Insurance is a regressive tax: the richer you are, the smaller the proportion of your income you pay. There are lots of different ways for the government to raise tax revenue - but they chose to hike a tax that minimally affects rich people.

Some elements in the media have managed to mention this, but most have focussed on Tory and Labour talking points that fail to address the fundamental issue: we need to tax the rich.

eBPF is Turing Complete

Wed, 19 Feb 2020 23:43:00 +0000

Recently my teammate and I were discussing our project with another colleague at the coffee machine. Our project is closely tied to eBPF. Our colleague didn’t really know what that was, so my team-mate summed it up as “a non-Turing-complete bytecode VM in the Linux kernel”. This triggered a pointless argument, which is the topic of this post.

My colleague’s rationale was that an eBPF program is only allowed to execute one million instructions. To use the traditional definition of Turing-completeness, that clearly means it cannot simulate the infinite “tape” of a Turing machine.

A Humiliating Update on 'Pangrammatic Autograms'

Sat, 07 Sep 2019 00:00:00 +0000

In my previous post on “pangrammatic autograms”, I included a cute tool to fiddle with these magical sentences and see whether they were correct. I then exclaimed (!) that the pan-autogram that I found in Hofstadter’s I Am A Strange Loop was incorrect!

Well, a Reddit user pointed out that I am a completely useless idiot and deserve to be cast into the North Sea on a raft of overripe bananas, because the reason why my cute tool found Hofstadter’s pangram to be bogus was simply that it didn’t account for capital letters. I usually consider myself a competent programmer so this is pretty embarrassing. I should probably add some daily self-flaggelation to my banana-raft itinerary.

Pangrammatic Autograms

Wed, 28 Aug 2019 00:00:00 +0000

In Gödel, Escher, Bach, Douglas Hofstadter lays out how self-reference underpins some staggering philosophical truths. Relatedly, it’s satisfying and funny. Pangrams - sentence containing every letter - are also satisfying, and though perhaps I never actually LOL’d at “the quick brown fox jumps over the lazy dog”, I think they’re sort of funny (maybe they are a weak form of Tom 7’s “improper hierarchy”).

So this, a sentence in Douglas Hofstadter’s later book I am a Strange Loop, is pretty captivating:

Finding a flashcard app to learn vocabulary

Sat, 09 Feb 2019 00:00:00 +0000

I wanted an app to learn Vietnamese vocab. My requirements are:

Easy to import and export cards, so you’re not locked in
Sensible interface for creating new cards
A smart system for deciding which cards need studying when

Of course you want a mobile app, so you can study in any spare moment, and so you can note down new vocab you encounter - straight into the memory hopper. Also in my case, Vietnamese has loads of diacritical marks which seem easier to deal with on a mobile keyboard.

Papi Picante's "Spicy Father" Noodle Soup

Sun, 30 Sep 2018 14:28:03 +0000

Here is the long-awaited recipe for Papi Picante’s “Spicy Father” sort-of-Sichuan-style noodle soup. ~~I forgot to take pictures of the actual food, so you’ll just have to make it to see how it looks~~.

You will need…

… To go to the Chinese supermarket. And get…

Fresh coriander, spring onions, garlic
Ginger (I just use ginger paste out of a jar)
Toasted sesame oil
Tofu. I use firm tofu but anything would work. The best would be the porous spongy type but I don’t know what this is called and I haven’t found it in shops.