Introducing Pow, a zero-configuration Rack server for Mac OS X • Hacker News Board

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#41

Post by jarin » Thu, Apr 07, 2011, 7:54 PM UTC

Let's take an informal poll: how many people grousing about the installation method were actually planning to install and use this?

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#42

Post by dpiddy » Thu, Apr 07, 2011, 7:55 PM UTC

FooBarWidget wrote: post #31

tptacek wrote: post #13

Earlier quoted context omitted.

Anyone who can run a tool to spoof DNS entries can run shell commands on machines that run this installer. Because so few people are going to install Pow relative to the population, I don't want to say this is a gigantic security problem. But the more people use this gimmick, the worse the issue gets. I think you would be doing the universe a small but meaningful favor not to advertise this installation mechanism. Bu…

Anybody can also spoof DNS entries to point rubygems.org/debian.org/centos.org/redhat.com to a malicious place where the packages contain postinstall scripts that run 'rm -rf /'.

Maybe for rubygems, not so easy for apt/rpm as they use gpg signing/verification of package indices.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#43

Post by jarin » Thu, Apr 07, 2011, 7:57 PM UTC

mjijackson wrote: post #21

Hooray! No more mucking around in /etc/hosts, .rvmrc, or .profile! Now you can muck around in ~/Library/Application Support/Pow/Hosts, .powrc, and .powenv instead! Thanks but no thanks. Do yourself a favor and learn how to install rack and nginx. It's already dirt simple, and you'll save yourself having to go back and learn it when it's time to deploy your app somewhere other than your laptop.

Or, you could NOT muck about in ~/Library/Application Support/Pow/Hosts, .powrc, and .powenv, and just symlink your app directories into ~/.pow, which is probably how 99% of developers will use it.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#44

Post by tptacek » Thu, Apr 07, 2011, 8:06 PM UTC

igorgue wrote: post #29

tptacek wrote: post #16

Earlier quoted context omitted.

If you download an installer from an https:// link, even though you still aren't capital-S Secure, you're still more secure than running shell scripts spat out over TCP port 80.

No you're not! It's the same security issue. You can for example, at your network level point get.pow.cx to a malicious script and you're done. That's the security issue, it has nothing to do with the HTTP protocol. With that being said, I don't care, the risk is the same as downloading any software via http, in fact I loved it, so easy :-).

Sorry, I just don't agree with this, but I also recognize it as a topic that we can nerd out over for hours and hours without improving the universe even a little. If what 'tptacek thinks about the security of software distribution means anything to you --- I'm not saying it has to --- then know that I think this is a bad idea that is only not causing problems because it is a gimmick used by so few projects.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#45

Post by whalesalad » Thu, Apr 07, 2011, 8:09 PM UTC

What the hell it's written in node.js and coffeescript. Color me impressed. I'm now motivated to tackle this for python.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#46

Post by mrkurt » Thu, Apr 07, 2011, 8:19 PM UTC

whalesalad wrote: post #45

What the hell it's written in node.js and coffeescript. Color me impressed. I'm now motivated to tackle this for python.

I don't know much about wsgi, but it seems like you could make a node.js wsgi adapter pretty easily.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#47

Post by wlll » Thu, Apr 07, 2011, 8:23 PM UTC

michaelfairley wrote: post #33

sstephenson wrote: post #22

Earlier quoted context omitted.

Just as anyone who can spoof DNS entries could swap some other theoretical Pow installer with a malicious one. I'm not seeing how Pow's installation process is any less secure than, say, downloading a disk image from a random site.

Not if it's served over SSL.

This comment is a repeat, but that may not necessarily be true:

http://www.imperialviolet.org/2011/03/18/revocation.html

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#48

Post by kemiller » Thu, Apr 07, 2011, 8:24 PM UTC

jarin wrote: post #28

kemiller wrote: post #25

Earlier quoted context omitted.

I don't think a brand-new webserver hack counts as a reputable source just yet.

I think 37signals counts as a reasonably reputable source if you're a Rails developer.

Oh, didn't notice that.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#49

Post by chrisledet » Thu, Apr 07, 2011, 8:25 PM UTC

Maybe it's just me but I can not seem to get any application to work. Chrome just says "Server Not Found". I tried to check the logs in ~/Library/Logs/Pow but the directory doesn't even exist. Didn't know if it was something silly before I created a ticket on Github.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#50

Post by sstephenson » Thu, Apr 07, 2011, 8:30 PM UTC

whalesalad wrote: post #45

What the hell it's written in node.js and coffeescript. Color me impressed. I'm now motivated to tackle this for python.

I'd love to see a WSGI adapter for Pow!

Check out Nack (https://github.com/josh/nack) to see how Pow runs Rack apps.