Earlier quoted context omitted.
yeah, that seemed to have fixed it. Terminal works, iTerm doesn't.
Same problem, but using Terminal.
Fixed with restarting my machine. And it's worth it.
Introducing Pow, a zero-configuration Rack server for Mac OS X
111–120 of 146 posts
Re: Introducing Pow, a zero-configuration Rack server for Mac OS X
#112Pretty awesome. It took a restart to get it to work, but it's great now. As a minor aside, is there a way to get Chrome to treat .dev domain the same as .com? Whenever I type in my .dev app name, it tries to google search for it.
Nice, you can change the env variable POW_DOMAIN to ".local". Much better in my opinion (works better with chrome at least) EDIT: scratch that. You can't do this.
[deleted]
Re: Introducing Pow, a zero-configuration Rack server for Mac OS X
#113[deleted]
Re: Introducing Pow, a zero-configuration Rack server for Mac OS X
#114Pow is a Node.js app written in CoffeeScript. It includes an HTTP and a DNS server and runs Rack apps by way of Josh Peek's Nack library: https://github.com/josh/nack The screencast shows how it works and why we made it: http://get.pow.cx/media/screencast.mov If you're interested, you can read the annotated source code, written in literate style and generated with the wonderful Docco: http://pow.cx/docs/
[deleted]
Re: Introducing Pow, a zero-configuration Rack server for Mac OS X
#115This is a great web page, but I think it's borderline irresponsible to keep using this gimmick: curl get.pow.cx | sh for installation. Yes, it's easy and slick. Yes, you'd have to read the code itself to make sure Pow didn't own your machine up after a secure install. Yes, you can just read the shell script. But 0.0001% of people playing with Pow will do that. Why make things easier for attackers at all? This is an i…
The point is that something like debian will SIGN packages. You'll have some guarantee that the package you receive is what the maintainers expected. This is not safely possible using this method even if SSL is used.
Re: Introducing Pow, a zero-configuration Rack server for Mac OS X
#116Pretty awesome. It took a restart to get it to work, but it's great now. As a minor aside, is there a way to get Chrome to treat .dev domain the same as .com? Whenever I type in my .dev app name, it tries to google search for it.
+1, I'd like to know that.
In the meantime, you can access a new app the first time by entering http://myapp.dev (including the http://). Looks like after that, Chrome treats myapp.dev as desired.
Re: Introducing Pow, a zero-configuration Rack server for Mac OS X
#117Earlier quoted context omitted.
As other have pointed out above, the point is not where you think it is coming from, it is where it is actually coming from. Someone could easily man in the middle the connection and change the code you download, so your computer ran whatever they wanted you to run.
You say someone could "easily" man-in-the-middle the connection, but is it really that easy? Or likely? (Assuming you're not installing it from a random public wifi hotspot.) Even so, assuming you want to be extra careful (you're installing it on a development machine with highly sensitive information), it's not that difficult to clone the repo and edit the install script to install from your local copy of the repo.
Had the packages been signed you could verify them (like deb packages).
Re: Introducing Pow, a zero-configuration Rack server for Mac OS X
#118Earlier quoted context omitted.
Agreed. The command made me nervous until I saw the 37signals logo. After that, I didn't think twice.
I mean yes, it does take a whole minute to verify that the pow code repo is on 37signals' GitHub organization account and that the repo references http://pow.cx . Although I suppose it is possible that 37signals' GitHub account was hacked and someone maliciously designed a convenient Rack server and website with the intent of targeting the lucrative Rails developer demographic, or that the package the installer downl…
I could trojan you on a public wifi network. You wouldn't know any better because the package does no verification.
Had we shared some information prior (like say the debian package manager) then you would be able to verify the package.
Re: Introducing Pow, a zero-configuration Rack server for Mac OS X
#119Earlier quoted context omitted.
No you're not! It's the same security issue. You can for example, at your network level point get.pow.cx to a malicious script and you're done. That's the security issue, it has nothing to do with the HTTP protocol. With that being said, I don't care, the risk is the same as downloading any software via http, in fact I loved it, so easy :-).
Sorry, I just don't agree with this, but I also recognize it as a topic that we can nerd out over for hours and hours without improving the universe even a little. If what 'tptacek thinks about the security of software distribution means anything to you --- I'm not saying it has to --- then know that I think this is a bad idea that is only not causing problems because it is a gimmick used by so few projects.
We get that you think it is a bad idea, but don't know/understand why/how?
Since you are the security expert at Hn, we are trying to understand/learn from you.
This is not plain Nerdgasm making people understand about software security is making the world a little better.
Re: Introducing Pow, a zero-configuration Rack server for Mac OS X
#120I love this. You simply create a symlink to your app, and boom, the app works at nameofthesymlink.dev. Even after a system restart. And pow is clever enough to only start workers if the app is accessed and shut them down when idle.
This is a blessing if you usually need multiple local apps running.
It also means you can now elegantly use local ruby webapps as personal desktop applications. Say you'd like to build a simple journal or expenses app to use on your desktop for personal use. You can now quickly build it with - say - Sinatra, Datamapper and SQLite. And no need to launch or quit it. Beautiful.