61–70 of 78 posts
Earlier quoted context omitted.
Yes. apt-get: $ ls -l /etc/apt/trusted.gpg.d/ Source Installation: $ wget http://nmap.org/dist/sigs/nmap-6.01.tgz.asc $ wget http://nmap.org/dist/nmap-6.01.tgz $ gpg nmap-6.01.tgz.asc
The point is that most people don't do this.
# apt-get --allow-unauthenticated ...Earlier quoted context omitted.
Homebrew, rbenv, rvm, to name a few. Never understood it either. If you could get ahold of a domain write a malicious script at /some-script.sh, you could do a lot of damage.
I agree that it feels insecure, but is there really a difference between this and downloading and running files from a .tar.gz or installing a .deb for example?
I hope the node installation never did one of these: curl -s -L http://nodejs.org/some-script.sh |sh I have never understood why people install software like that. I can not remember which project it is that uses this in the installation.
There is a lot of self-righteous dickishness and schadenfraude in these responses. Proclaiming there to be "NO excuse" to someone who has worked their ass off to create a stellar open-source project really says more about yourself than the person you are attacking. Most certainly there is some sort of explanation, and whether or not it was a terrible mistake, being a jerk about it doesn't relieve you from the terribl…
This site appeals to the absolute worst in everyone. I find myself becoming an asshole every time I come here, and I don't like that feeling.
There is a lot of self-righteous dickishness and schadenfraude in these responses. Proclaiming there to be "NO excuse" to someone who has worked their ass off to create a stellar open-source project really says more about yourself than the person you are attacking. Most certainly there is some sort of explanation, and whether or not it was a terrible mistake, being a jerk about it doesn't relieve you from the terribl…
I hope the node installation never did one of these: curl -s -L http://nodejs.org/some-script.sh |sh I have never understood why people install software like that. I can not remember which project it is that uses this in the installation.
Would adding a hash check for some-script.sh solve the security issue?
Distributing a hash check over HTTPS would offer some protection against man in the middle style attacks, to the extent that TLS protects against man in the middle attacks, but accomplishes nothing if the server has been compromised.
Distributing a signature of the download gives stronger protection, because the private key can be kept offline and encrypted except when in use. Breaking into a server and overwriting a few files is easier than breaking into someone's laptop in the brief moment where they unlock their keypair to sign a release.
Sorry, folks. My bad. The root cause here is that some stuff didn't get handed over properly in the switch from Ryan to me as Node.js manager. So, the emails were indeed going to a non-functioning inbox. It's resolved now, and we're setting it up to auto-renew so that this doesn't happen again.
tl;dr: He who controls the DNS, controls the universe.
Sorry, folks. My bad. The root cause here is that some stuff didn't get handed over properly in the switch from Ryan to me as Node.js manager. So, the emails were indeed going to a non-functioning inbox. It's resolved now, and we're setting it up to auto-renew so that this doesn't happen again.
It's kind of amazing how much certain data (in this case, a record in DNS) comes to mean to people. And how much we come to rely on that little bit of data. And really, how much we trust the DNS system and it's maintainers. "Ruling the world" might be difficult, but "ruling the internet" appears to be a matter of controlling DNS and then mimicking well-known sites well enough to install arbitrary software on every PC…
I hope the node installation never did one of these: curl -s -L http://nodejs.org/some-script.sh |sh I have never understood why people install software like that. I can not remember which project it is that uses this in the installation.
Earlier quoted context omitted.
eNom does all kinds of shady shenanigans with domain renewals. There are stories of names going up on their auction block the moment the registration expires (meaning someone has to pay a greatly inflated amount of cash to reclaim the name)
Unlikely. As much as enom sucks I don't think one could misconstrue any of their ineptitude as evil. They do however have the redemption period at inflated prices, but I've never heard of them moving an expired domain to immediate auction. [citation please]
Start here.