Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Pow, a zero-configuration Rack server for Mac OS X

pow.cx

Post reply on HN
Print view View original

71–80 of 146 posts

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#71

Post by akkartik »

scott_s wrote: post #66
tptacek wrote: post #64

Earlier quoted context omitted.

HTTPS, automatic installation, and UX that confounds security for end-users are my three objections to this gimmick.

I was assuming HTTPS based on this thread chain, but even in practice, most installers I see aren't downloaded over HTTPS. How does this practice confound security more than a normal installer? sudo asks for my password just as a normal installer would.

It's easier for a man in the middle to change a 15-line text script than to change a binary. Lowering that effort = increasing the odds and incidence of attempted attacks.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#72

Post by marbletiles »

Installation wasn't easy or slick here:

  *** Installing local configuration files...

  /Users/bonaldi/Library/Application Support/Pow/Versions/0.2.2/lib/command.js:50
            throw err;
            ^
  Error: EACCES, Permission denied   '/Users/bonaldi/Library/LaunchAgents/cx.pow.powd.plist'

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#74

Post by tlrobinson »

koenigdavidmj wrote: post #3

I do not much like this 'curl $random_url | sh' installation method. I am not going to be running some random script without looking long and hard at it first.

Do you read through the source of every piece of software you download and install? If not then why worry about one shell script?

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#75

Post by ptomato »

mickeyben wrote: post #10

gem install passenger passenger start no preference panes to install. No Apache configuration files to update. And Passenger eliminates the need to edit /etc/hosts. To get a Rack app running, just type a single command.

I'm a huge passenger fan, but I should note that:

* this is also a single command to get a rack app running once you have it installed

* you can easily support multiple ruby versions/gemsets (otherwise you'd need to install/compile passenger for each)

* appname.dev is easier than remembering which port all of your rails apps are running on.

* you don't have to start each app manually each time.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#76

Post by jarin »

telemachos wrote: post #69
msbarnett wrote: post #68

Earlier quoted context omitted.

As near as I can tell at the moment, it doesn't seem to respect any gemsets specified in your project .rvmrc, just the ruby interpreter specified.

Odd - my two apps have identical .rvmrc files (both using the same interpreter and gemset). Even odder, the first app is now working, and I'm completely not sure why.

If you haven't already, open Console.app, show the log list and there's a set of Pow logs in there. It might help out.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#78

Post by tlrobinson »

tptacek wrote: post #6

This is a great web page, but I think it's borderline irresponsible to keep using this gimmick: curl get.pow.cx | sh for installation. Yes, it's easy and slick. Yes, you'd have to read the code itself to make sure Pow didn't own your machine up after a secure install. Yes, you can just read the shell script. But 0.0001% of people playing with Pow will do that. Why make things easier for attackers at all? This is an i…

I suppose you could define a curl wrapper that lets you review the file before passing it along to sh...

    curl_review() {
        result=`curl "$@"`
        echo "$result" > `tty`
        echo "Enter to proceed, Ctrl-C to abort:" > `tty`
        read
        echo "$result"
    }
Then just change curl to curl_review:

    curl_review get.pow.cx | sh
Of course this kind of defeats the purpose of these easy installation tricks.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#79

Post by msbarnett »

telemachos wrote: post #69
msbarnett wrote: post #68

Earlier quoted context omitted.

As near as I can tell at the moment, it doesn't seem to respect any gemsets specified in your project .rvmrc, just the ruby interpreter specified.

Odd - my two apps have identical .rvmrc files (both using the same interpreter and gemset). Even odder, the first app is now working, and I'm completely not sure why.

It turned out my issue was being caused because I was running an older version of rvm. Updating fixed it.

Re: Introducing Pow, a zero-configuration Rack server for Mac OS X

#80

Post by scott_s »

akkartik wrote: post #71
scott_s wrote: post #66

Earlier quoted context omitted.

I was assuming HTTPS based on this thread chain, but even in practice, most installers I see aren't downloaded over HTTPS. How does this practice confound security more than a normal installer? sudo asks for my password just as a normal installer would.

It's easier for a man in the middle to change a 15-line text script than to change a binary. Lowering that effort = increasing the odds and incidence of attempted attacks.

I request one thing, you send me something completely different. I don't see how making the "something" an ASCII script makes it easier than a random binary (and there's no requirement that the random binary has any relationship with what I requested).

Oddly, I'm more used to seeing arguments that distributing source code is better than distributing binaries because you can inspect source code.

Post reply on HN