Introducing Pow, a zero-configuration Rack server for Mac OS X • Hacker News Board

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#11

Post by sstephenson » Thu, Apr 07, 2011, 6:44 PM UTC

tptacek wrote: post #6

This is a great web page, but I think it's borderline irresponsible to keep using this gimmick: curl get.pow.cx | sh for installation. Yes, it's easy and slick. Yes, you'd have to read the code itself to make sure Pow didn't own your machine up after a secure install. Yes, you can just read the shell script. But 0.0001% of people playing with Pow will do that. Why make things easier for attackers at all? This is an i…

Hey Tom-

The installation process is short and fully documented: http://get.pow.cx/

The web site and manual encourage you to read it.

I think it's far more transparent than, say, an OS X Installer package.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#12

Post by sstephenson » Thu, Apr 07, 2011, 6:45 PM UTC

mickeyben wrote: post #10

gem install passenger passenger start no preference panes to install. No Apache configuration files to update. And Passenger eliminates the need to edit /etc/hosts. To get a Rack app running, just type a single command.

You conveniently omitted the step where you get an app running.

And upgrading Passenger requires you to install a gem, then run a command, copy and paste a bunch of text into your Apache config file, and restart Apache.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#13

Post by tptacek » Thu, Apr 07, 2011, 6:52 PM UTC

sstephenson wrote: post #11

tptacek wrote: post #6

This is a great web page, but I think it's borderline irresponsible to keep using this gimmick: curl get.pow.cx | sh for installation. Yes, it's easy and slick. Yes, you'd have to read the code itself to make sure Pow didn't own your machine up after a secure install. Yes, you can just read the shell script. But 0.0001% of people playing with Pow will do that. Why make things easier for attackers at all? This is an i…

Hey Tom- The installation process is short and fully documented: http://get.pow.cx/ The web site and manual encourage you to read it. I think it's far more transparent than, say, an OS X Installer package.

Anyone who can run a tool to spoof DNS entries can run shell commands on machines that run this installer. Because so few people are going to install Pow relative to the population, I don't want to say this is a gigantic security problem. But the more people use this gimmick, the worse the issue gets.

I think you would be doing the universe a small but meaningful favor not to advertise this installation mechanism.

But it is a very cool tool and a really well-done site. Congrats!

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#14

Post by clint » Thu, Apr 07, 2011, 6:52 PM UTC

mickeyben wrote: post #10

gem install passenger passenger start no preference panes to install. No Apache configuration files to update. And Passenger eliminates the need to edit /etc/hosts. To get a Rack app running, just type a single command.

I did this and soon my computer was downloading and compiling nginx.

When this finished, I got an error and it all failed: "* ERROR: Please install file-tail first: sudo gem install file-tail"…

So I did and now its supposedly running on Port 3000 except I just get a 403 error when I visit it in my browser. The docs aren't very helpful either (http://www.modrails.com/documentation/Users%20guide%20Standa...).

Update: I apparently missed the line about going to my application's root directory. I still didn't really like all the stuff that got downloaded and compiled on my machine, when all I would like to do is get started developing.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#15

Post by jarin » Thu, Apr 07, 2011, 6:53 PM UTC

mickeyben wrote: post #10

gem install passenger passenger start no preference panes to install. No Apache configuration files to update. And Passenger eliminates the need to edit /etc/hosts. To get a Rack app running, just type a single command.

There are some drawbacks to using Passenger/Mongrel/Webrick for development though, especially when you need to test subdomains and/or SSL.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#16

Post by tptacek » Thu, Apr 07, 2011, 6:53 PM UTC

burke wrote: post #8

tptacek wrote: post #6

This is a great web page, but I think it's borderline irresponsible to keep using this gimmick: curl get.pow.cx | sh for installation. Yes, it's easy and slick. Yes, you'd have to read the code itself to make sure Pow didn't own your machine up after a secure install. Yes, you can just read the shell script. But 0.0001% of people playing with Pow will do that. Why make things easier for attackers at all? This is an i…

Why is this bad? I get why it seems offensive, but how is running a random shell script from some host any different than running some random software downloaded and installed from the same host? Anything malicious that the shell script could do could also be done by the software itself once installed, no? If they're from the same official source, why should one be considered more trustworthy than the other? EDIT: Ok…

If you download an installer from an https:// link, even though you still aren't capital-S Secure, you're still more secure than running shell scripts spat out over TCP port 80.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#17

Post by jarin » Thu, Apr 07, 2011, 6:56 PM UTC

sstephenson wrote: post #11

tptacek wrote: post #6

This is a great web page, but I think it's borderline irresponsible to keep using this gimmick: curl get.pow.cx | sh for installation. Yes, it's easy and slick. Yes, you'd have to read the code itself to make sure Pow didn't own your machine up after a secure install. Yes, you can just read the shell script. But 0.0001% of people playing with Pow will do that. Why make things easier for attackers at all? This is an i…

Hey Tom- The installation process is short and fully documented: http://get.pow.cx/ The web site and manual encourage you to read it. I think it's far more transparent than, say, an OS X Installer package.

It might also be nice to have a Homebrew recipe, if it's possible to run it from /usr/local instead of ~/Library/Application Support (haven't dug through the code yet).

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#18

Post by jarin » Thu, Apr 07, 2011, 6:59 PM UTC

tptacek wrote: post #6

This is a great web page, but I think it's borderline irresponsible to keep using this gimmick: curl get.pow.cx | sh for installation. Yes, it's easy and slick. Yes, you'd have to read the code itself to make sure Pow didn't own your machine up after a secure install. Yes, you can just read the shell script. But 0.0001% of people playing with Pow will do that. Why make things easier for attackers at all? This is an i…

Well, just to play devil's advocate, do you read through the source code of MySQL, Apache, or RPM packages every time you install them?

With things like this that come from reputable sources, it's not unreasonable to put some trust in the source and some trust in the smaller percentage of developers who actually read the source code.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#19

Post by burke » Thu, Apr 07, 2011, 6:59 PM UTC

tptacek wrote: post #16

burke wrote: post #8

Earlier quoted context omitted.

Why is this bad? I get why it seems offensive, but how is running a random shell script from some host any different than running some random software downloaded and installed from the same host? Anything malicious that the shell script could do could also be done by the software itself once installed, no? If they're from the same official source, why should one be considered more trustworthy than the other? EDIT: Ok…

If you download an installer from an https:// link, even though you still aren't capital-S Secure, you're still more secure than running shell scripts spat out over TCP port 80.

Sure, but a huge amount of software is distributed over plain old HTTP anyway. I agree that we should be using HTTPS for things like this, but I don't buy that curling a shell script is worse than downloading an installer over an unencrypted connection.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#20

Post by FooBarWidget » Thu, Apr 07, 2011, 6:59 PM UTC

sstephenson wrote: post #12

mickeyben wrote: post #10

gem install passenger passenger start no preference panes to install. No Apache configuration files to update. And Passenger eliminates the need to edit /etc/hosts. To get a Rack app running, just type a single command.

You conveniently omitted the step where you get an app running. And upgrading Passenger requires you to install a gem, then run a command, copy and paste a bunch of text into your Apache config file, and restart Apache.

Not in the example he gave. He was using Phusion Passenger Standalone, i.e. not Phusion Passenger for Apache. Phusion Passenger Standalone does not require an external web server. It literally is just running 'passenger start'. No config files to edit. http://blog.phusion.nl/2010/07/01/the-road-to-passenger-3-te...