Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Pow, a zero-configuration Rack server for Mac OS X

pow.cx

Post reply on HN
Print view View original

31–40 of 146 posts

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#31

Post by FooBarWidget »

tptacek wrote: post #13
sstephenson wrote: post #11

Earlier quoted context omitted.

Hey Tom- The installation process is short and fully documented: http://get.pow.cx/ The web site and manual encourage you to read it. I think it's far more transparent than, say, an OS X Installer package.

Anyone who can run a tool to spoof DNS entries can run shell commands on machines that run this installer. Because so few people are going to install Pow relative to the population, I don't want to say this is a gigantic security problem. But the more people use this gimmick, the worse the issue gets. I think you would be doing the universe a small but meaningful favor not to advertise this installation mechanism. Bu…

Anybody can also spoof DNS entries to point rubygems.org/debian.org/centos.org/redhat.com to a malicious place where the packages contain postinstall scripts that run 'rm -rf /'.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#32

Post by clint »

FooBarWidget wrote: post #27
clint wrote: post #14

Earlier quoted context omitted.

I did this and soon my computer was downloading and compiling nginx. When this finished, I got an error and it all failed: " * ERROR: Please install file-tail first: sudo gem install file-tail"… So I did and now its supposedly running on Port 3000 except I just get a 403 error when I visit it in my browser. The docs aren't very helpful either ( http://www.modrails.com/documentation/Users%20guide%20Standa... ). Update…

I'm a Phusion Passenger developer. The goal for Phusion Passenger Standalone really is to have the command 'passenger start' Just Work(tm). After installing all required libraries, if it says it's running on port 3000 and it doesn't, then it's either a bug which we are dedicated to fix, or there might be something wrong with your system. The 'file-tail' thing is actually a bug (we should no longer have a requirement…

Sorry :( I made a reading error and I updated my post.

It still seems like a lot of software and time to just start developing. What does passenger get me for developing locally that Pow doesn't? (I've never used Passenger before today).

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#33

Post by michaelfairley »

sstephenson wrote: post #22
tptacek wrote: post #13

Earlier quoted context omitted.

Anyone who can run a tool to spoof DNS entries can run shell commands on machines that run this installer. Because so few people are going to install Pow relative to the population, I don't want to say this is a gigantic security problem. But the more people use this gimmick, the worse the issue gets. I think you would be doing the universe a small but meaningful favor not to advertise this installation mechanism. Bu…

Just as anyone who can spoof DNS entries could swap some other theoretical Pow installer with a malicious one. I'm not seeing how Pow's installation process is any less secure than, say, downloading a disk image from a random site.

Not if it's served over SSL.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#34

Post by pdenya »

jarin wrote: post #28
kemiller wrote: post #25

Earlier quoted context omitted.

I don't think a brand-new webserver hack counts as a reputable source just yet.

I think 37signals counts as a reasonably reputable source if you're a Rails developer.

Agreed. The command made me nervous until I saw the 37signals logo. After that, I didn't think twice.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#35

Post by FooBarWidget »

clint wrote: post #32
FooBarWidget wrote: post #27

Earlier quoted context omitted.

I'm a Phusion Passenger developer. The goal for Phusion Passenger Standalone really is to have the command 'passenger start' Just Work(tm). After installing all required libraries, if it says it's running on port 3000 and it doesn't, then it's either a bug which we are dedicated to fix, or there might be something wrong with your system. The 'file-tail' thing is actually a bug (we should no longer have a requirement…

Sorry :( I made a reading error and I updated my post. It still seems like a lot of software and time to just start developing. What does passenger get me for developing locally that Pow doesn't? (I've never used Passenger before today).

I can't comment on how Phusion Passenger Standalone differs from Pow because I've never used Pow. However I can tell you what Phusion Passenger Standalone's benefits are:

1. Phusion Passenger is currently the most popular production server for Ruby web apps (see ruby-toolbox.com and the last NewRelic survey). Phusion Passenger Standalone is practically the same as Phusion Passenger for Nginx. It's a good thing to have the development environment match the production environment as much as possible. Phusion Passenger actually comes in 3 editions: Phusion Passenger for Apache (integrates into Apache), Phusion Passenger for Nginx (integrates into Nginx) and Phusion Passenger Standalone (can run by itself, does not require an external web server).

2. Because Standalone is based on an Nginx core it's even fit for production. According to the Pow website it uses Nack, which according to its website is not ready for production. If 'passenger start' works for you locally then you can run the same thing in production. No need to learn how Apache and Nginx works.

There are other things as well, but I have to go in a few minutes. Feel free to ask me more questions if you like.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#36

Post by FooBarWidget »

clint wrote: post #32
FooBarWidget wrote: post #27

Earlier quoted context omitted.

I'm a Phusion Passenger developer. The goal for Phusion Passenger Standalone really is to have the command 'passenger start' Just Work(tm). After installing all required libraries, if it says it's running on port 3000 and it doesn't, then it's either a bug which we are dedicated to fix, or there might be something wrong with your system. The 'file-tail' thing is actually a bug (we should no longer have a requirement…

Sorry :( I made a reading error and I updated my post. It still seems like a lot of software and time to just start developing. What does passenger get me for developing locally that Pow doesn't? (I've never used Passenger before today).

As for "the stuff that got downloaded and compiled on my machine", that's Nginx being downloaded and compiled there. Nginx is a high-performance, lightweight, extremely stable, battle-tested and proven web server.

Hypothetically speaking, it's possible to modify Phusion Passenger to not download and install Nginx. We can run on a pure-Ruby web server like WEBrick. However I guarantee you, WEBrick sucks; it's slow, buggy and leaks memory.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#37

Post by bradleyland »

burke wrote: post #7
koenigdavidmj wrote: post #3

I do not much like this 'curl $random_url | sh' installation method. I am not going to be running some random script without looking long and hard at it first.

I don't understand how this is any different from running the application after you install it by whatever other method. Your shell doesn't have some higher level of access than most other software.

> I don't understand how this is any different from running the application after you install it

I'll tell you one difference. It takes me 10 minutes to review the shell based installer. It takes a whole lot longer to inspect an installation package or application source code.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#38

Post by wlll »

FooBarWidget wrote: post #30
igorgue wrote: post #29

Earlier quoted context omitted.

No you're not! It's the same security issue. You can for example, at your network level point get.pow.cx to a malicious script and you're done. That's the security issue, it has nothing to do with the HTTP protocol. With that being said, I don't care, the risk is the same as downloading any software via http, in fact I loved it, so easy :-).

You mean DNS spoofing. That only works if you can get a valid certificate at one of the recognized CAs. If you use a self-signed one curl will still complain unless -k is given. But then again, after the Comodo fiasco...

Maybe not entirely true: http://www.imperialviolet.org/2011/03/18/revocation.html

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#39

Post by jarin »

pdenya wrote: post #34
jarin wrote: post #28

Earlier quoted context omitted.

I think 37signals counts as a reasonably reputable source if you're a Rails developer.

Agreed. The command made me nervous until I saw the 37signals logo. After that, I didn't think twice.

I mean yes, it does take a whole minute to verify that the pow code repo is on 37signals' GitHub organization account and that the repo references http://pow.cx.

Although I suppose it is possible that 37signals' GitHub account was hacked and someone maliciously designed a convenient Rack server and website with the intent of targeting the lucrative Rails developer demographic, or that the package the installer downloads is an insidious 37signals trojan not built from the code at the public repo.

Point taken.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#40

Post by ericmoritz »

igorgue wrote: post #29
tptacek wrote: post #16

Earlier quoted context omitted.

If you download an installer from an https:// link, even though you still aren't capital-S Secure, you're still more secure than running shell scripts spat out over TCP port 80.

No you're not! It's the same security issue. You can for example, at your network level point get.pow.cx to a malicious script and you're done. That's the security issue, it has nothing to do with the HTTP protocol. With that being said, I don't care, the risk is the same as downloading any software via http, in fact I loved it, so easy :-).

In fact it's much more transparent. With a compiled binary you don't see the steps involved, with a bash script you can step line by line and see exactly what the script is doing.

Those that don't care won't look at the script any more than they'll check the md5 hash of a binary to see that it's a legit binary. For those that care, they can look at the bash source.

Post reply on HN