Introducing Pow, a zero-configuration Rack server for Mac OS X

Post by [deleted] » Fri, Apr 08, 2011, 2:02 AM UTC

akkartik wrote: post #97

scott_s wrote: post #80

Earlier quoted context omitted.

I request one thing, you send me something completely different. I don't see how making the "something" an ASCII script makes it easier than a random binary (and there's no requirement that the random binary has any relationship with what I requested). Oddly, I'm more used to seeing arguments that distributing source code is better than distributing binaries because you can inspect source code.

The scenario isn't that I send you something different, but that somebody else gets in between us and tampers with the data. That's what https tries to avoid. We're arguing levels of badness here so it's a little hokey. But if you decide to open up your machine to run arbitrary code, a machine that can run shell will arguably get more infections than one that runs executables. To infect the ladder any script kiddies…

Post by tvon » Fri, Apr 08, 2011, 2:39 AM UTC

    function pow {
        if [ -d "`cd $1; pwd`" ]; then
            ln -s "`cd $1; pwd`" ~/.pow/
        fi
    }

Post by illumin8 » Fri, Apr 08, 2011, 3:12 AM UTC

tptacek wrote: post #6

This is a great web page, but I think it's borderline irresponsible to keep using this gimmick: curl get.pow.cx | sh for installation. Yes, it's easy and slick. Yes, you'd have to read the code itself to make sure Pow didn't own your machine up after a secure install. Yes, you can just read the shell script. But 0.0001% of people playing with Pow will do that. Why make things easier for attackers at all? This is an i…

Post by gnufied » Fri, Apr 08, 2011, 3:52 AM UTC

scott_s wrote: post #63

tptacek wrote: post #57

Earlier quoted context omitted.

It would improve the situation but I'm still not a fan of perpetuating the pipe-into-shell idiom.

The only meaningful difference between the two techniques is the extra step required to explicitly execute an installer. Is that your objection, that you don't like something being automatically executed upon download?

Post by stephth » Fri, Apr 08, 2011, 4:51 AM UTC

chrisledet wrote: post #89

Deadsunrise wrote: post #56

Earlier quoted context omitted.

yep, same thing here. I get this if I launch it manually on 10.6.7: launchctl load "$HOME/Library/LaunchAgents/cx.pow.powd.plist" Bug: launchctl.c:2325 (23930):13: (dbfd = open(g_job_overrides_db_path, O_RDONLY | O_EXLOCK | O_CREAT, S_IRUSR | S_IWUSR)) != -1 launch_msg(): Socket is not connected

yeah, that seemed to have fixed it. Terminal works, iTerm doesn't.