21–30 of 146 posts
Thanks but no thanks. Do yourself a favor and learn how to install rack and nginx. It's already dirt simple, and you'll save yourself having to go back and learn it when it's time to deploy your app somewhere other than your laptop.
Earlier quoted context omitted.
Hey Tom- The installation process is short and fully documented: http://get.pow.cx/ The web site and manual encourage you to read it. I think it's far more transparent than, say, an OS X Installer package.
Anyone who can run a tool to spoof DNS entries can run shell commands on machines that run this installer. Because so few people are going to install Pow relative to the population, I don't want to say this is a gigantic security problem. But the more people use this gimmick, the worse the issue gets. I think you would be doing the universe a small but meaningful favor not to advertise this installation mechanism. Bu…
I'm not seeing how Pow's installation process is any less secure than, say, downloading a disk image from a random site.
Earlier quoted context omitted.
Why is this bad? I get why it seems offensive, but how is running a random shell script from some host any different than running some random software downloaded and installed from the same host? Anything malicious that the shell script could do could also be done by the software itself once installed, no? If they're from the same official source, why should one be considered more trustworthy than the other? EDIT: Ok…
If you download an installer from an https:// link, even though you still aren't capital-S Secure, you're still more secure than running shell scripts spat out over TCP port 80.
curl https://get.pow.cx/ | sh
Pow is a Node.js app written in CoffeeScript. It includes an HTTP and a DNS server and runs Rack apps by way of Josh Peek's Nack library: https://github.com/josh/nack The screencast shows how it works and why we made it: http://get.pow.cx/media/screencast.mov If you're interested, you can read the annotated source code, written in literate style and generated with the wonderful Docco: http://pow.cx/docs/
This is a great web page, but I think it's borderline irresponsible to keep using this gimmick: curl get.pow.cx | sh for installation. Yes, it's easy and slick. Yes, you'd have to read the code itself to make sure Pow didn't own your machine up after a secure install. Yes, you can just read the shell script. But 0.0001% of people playing with Pow will do that. Why make things easier for attackers at all? This is an i…
Well, just to play devil's advocate, do you read through the source code of MySQL, Apache, or RPM packages every time you install them? With things like this that come from reputable sources, it's not unreasonable to put some trust in the source and some trust in the smaller percentage of developers who actually read the source code.
I do not much like this 'curl $random_url | sh' installation method. I am not going to be running some random script without looking long and hard at it first.
It's a one-page script and a reasonably small, public git repo, from a company that doesn't exactly have a reputation for hacky, unreliable software.
gem install passenger passenger start no preference panes to install. No Apache configuration files to update. And Passenger eliminates the need to edit /etc/hosts. To get a Rack app running, just type a single command.
I did this and soon my computer was downloading and compiling nginx. When this finished, I got an error and it all failed: " * ERROR: Please install file-tail first: sudo gem install file-tail"… So I did and now its supposedly running on Port 3000 except I just get a 403 error when I visit it in my browser. The docs aren't very helpful either ( http://www.modrails.com/documentation/Users%20guide%20Standa... ). Update…
The 'file-tail' thing is actually a bug (we should no longer have a requirement on file-tail). We've already fixed it in git master 3 days ago and the fix will be released very soon.
Can you give me some more details about the 403 error? Do you see anything in the console or in the browser window that tells you more about the error?
Earlier quoted context omitted.
Well, just to play devil's advocate, do you read through the source code of MySQL, Apache, or RPM packages every time you install them? With things like this that come from reputable sources, it's not unreasonable to put some trust in the source and some trust in the smaller percentage of developers who actually read the source code.
I don't think a brand-new webserver hack counts as a reputable source just yet.
Earlier quoted context omitted.
Why is this bad? I get why it seems offensive, but how is running a random shell script from some host any different than running some random software downloaded and installed from the same host? Anything malicious that the shell script could do could also be done by the software itself once installed, no? If they're from the same official source, why should one be considered more trustworthy than the other? EDIT: Ok…
If you download an installer from an https:// link, even though you still aren't capital-S Secure, you're still more secure than running shell scripts spat out over TCP port 80.
You can for example, at your network level point get.pow.cx to a malicious script and you're done. That's the security issue, it has nothing to do with the HTTP protocol.
With that being said, I don't care, the risk is the same as downloading any software via http, in fact I loved it, so easy :-).
Earlier quoted context omitted.
If you download an installer from an https:// link, even though you still aren't capital-S Secure, you're still more secure than running shell scripts spat out over TCP port 80.
No you're not! It's the same security issue. You can for example, at your network level point get.pow.cx to a malicious script and you're done. That's the security issue, it has nothing to do with the HTTP protocol. With that being said, I don't care, the risk is the same as downloading any software via http, in fact I loved it, so easy :-).