51–60 of 146 posts
Pow is a Node.js app written in CoffeeScript. It includes an HTTP and a DNS server and runs Rack apps by way of Josh Peek's Nack library: https://github.com/josh/nack The screencast shows how it works and why we made it: http://get.pow.cx/media/screencast.mov If you're interested, you can read the annotated source code, written in literate style and generated with the wonderful Docco: http://pow.cx/docs/
Earlier quoted context omitted.
No you're not! It's the same security issue. You can for example, at your network level point get.pow.cx to a malicious script and you're done. That's the security issue, it has nothing to do with the HTTP protocol. With that being said, I don't care, the risk is the same as downloading any software via http, in fact I loved it, so easy :-).
Sorry, I just don't agree with this, but I also recognize it as a topic that we can nerd out over for hours and hours without improving the universe even a little. If what 'tptacek thinks about the security of software distribution means anything to you --- I'm not saying it has to --- then know that I think this is a bad idea that is only not causing problems because it is a gimmick used by so few projects.
Maybe it's just me but I can not seem to get any application to work. Chrome just says "Server Not Found". I tried to check the logs in ~/Library/Logs/Pow but the directory doesn't even exist. Didn't know if it was something silly before I created a ticket on Github.
launchctl load "$HOME/Library/LaunchAgents/cx.pow.powd.plist" Earlier quoted context omitted.
If you download an installer from an https:// link, even though you still aren't capital-S Secure, you're still more secure than running shell scripts spat out over TCP port 80.
So would, curl https://get.pow.cx/ | sh Fix your complaint? Like the grandparent said, I'm not sure why curl | sh is any less secure than gem install or whathaveyou, in the oh-god-this-script-just-ran-rm-rf-/ sense.
This is a great web page, but I think it's borderline irresponsible to keep using this gimmick: curl get.pow.cx | sh for installation. Yes, it's easy and slick. Yes, you'd have to read the code itself to make sure Pow didn't own your machine up after a secure install. Yes, you can just read the shell script. But 0.0001% of people playing with Pow will do that. Why make things easier for attackers at all? This is an i…
Well, just to play devil's advocate, do you read through the source code of MySQL, Apache, or RPM packages every time you install them? With things like this that come from reputable sources, it's not unreasonable to put some trust in the source and some trust in the smaller percentage of developers who actually read the source code.
Maybe it's just me but I can not seem to get any application to work. Chrome just says "Server Not Found". I tried to check the logs in ~/Library/Logs/Pow but the directory doesn't even exist. Didn't know if it was something silly before I created a ticket on Github.
yep, same thing here. I get this if I launch it manually on 10.6.7: launchctl load "$HOME/Library/LaunchAgents/cx.pow.powd.plist" Bug: launchctl.c:2325 (23930):13: (dbfd = open(g_job_overrides_db_path, O_RDONLY | O_EXLOCK | O_CREAT, S_IRUSR | S_IWUSR)) != -1 launch_msg(): Socket is not connected
edit: I only get the error using tmux, strange..
Earlier quoted context omitted.
If you download an installer from an https:// link, even though you still aren't capital-S Secure, you're still more secure than running shell scripts spat out over TCP port 80.
So would, curl https://get.pow.cx/ | sh Fix your complaint? Like the grandparent said, I'm not sure why curl | sh is any less secure than gem install or whathaveyou, in the oh-god-this-script-just-ran-rm-rf-/ sense.