61–70 of 146 posts
Earlier quoted context omitted.
Anybody can also spoof DNS entries to point rubygems.org/debian.org/centos.org/redhat.com to a malicious place where the packages contain postinstall scripts that run 'rm -rf /'.
Maybe for rubygems, not so easy for apt/rpm as they use gpg signing/verification of package indices.
Earlier quoted context omitted.
Just as anyone who can spoof DNS entries could swap some other theoretical Pow installer with a malicious one. I'm not seeing how Pow's installation process is any less secure than, say, downloading a disk image from a random site.
Not if it's served over SSL.
Earlier quoted context omitted.
So would, curl https://get.pow.cx/ | sh Fix your complaint? Like the grandparent said, I'm not sure why curl | sh is any less secure than gem install or whathaveyou, in the oh-god-this-script-just-ran-rm-rf-/ sense.
It would improve the situation but I'm still not a fan of perpetuating the pipe-into-shell idiom.
Earlier quoted context omitted.
It would improve the situation but I'm still not a fan of perpetuating the pipe-into-shell idiom.
The only meaningful difference between the two techniques is the extra step required to explicitly execute an installer. Is that your objection, that you don't like something being automatically executed upon download?
Hooray! No more mucking around in /etc/hosts, .rvmrc, or .profile! Now you can muck around in ~/Library/Application Support/Pow/Hosts, .powrc, and .powenv instead! Thanks but no thanks. Do yourself a favor and learn how to install rack and nginx. It's already dirt simple, and you'll save yourself having to go back and learn it when it's time to deploy your app somewhere other than your laptop.
Or, you could NOT muck about in ~/Library/Application Support/Pow/Hosts, .powrc, and .powenv, and just symlink your app directories into ~/.pow, which is probably how 99% of developers will use it.
The downside of zero configuration is "What do you do when it doesn't just work?" (I'm digging around the manual now...)
(A quick follow-up: The second app I symlinked in the exact same way does "Just work", so I don't doubt that there's something odd about my config for the first. Still, no fun to debug.)
Earlier quoted context omitted.
The only meaningful difference between the two techniques is the extra step required to explicitly execute an installer. Is that your objection, that you don't like something being automatically executed upon download?
HTTPS, automatic installation, and UX that confounds security for end-users are my three objections to this gimmick.
How does this practice confound security more than a normal installer? sudo asks for my password just as a normal installer would.
Earlier quoted context omitted.
The only meaningful difference between the two techniques is the extra step required to explicitly execute an installer. Is that your objection, that you don't like something being automatically executed upon download?
HTTPS, automatic installation, and UX that confounds security for end-users are my three objections to this gimmick.
Earlier quoted context omitted.
Or, you could NOT muck about in ~/Library/Application Support/Pow/Hosts, .powrc, and .powenv, and just symlink your app directories into ~/.pow, which is probably how 99% of developers will use it.
In fairness to the parent post, it may not always be that simple. I installed, symlinked as you described and am currently looking at a page filled with "Pow: Error Starting Application". (Apparently it thinks I don't have Bundler installed. This is likely an issue because of pow + rvm + gemsets + factor x.) The downside of zero configuration is "What do you do when it doesn't just work?" (I'm digging around the manu…
Earlier quoted context omitted.
In fairness to the parent post, it may not always be that simple. I installed, symlinked as you described and am currently looking at a page filled with "Pow: Error Starting Application". (Apparently it thinks I don't have Bundler installed. This is likely an issue because of pow + rvm + gemsets + factor x.) The downside of zero configuration is "What do you do when it doesn't just work?" (I'm digging around the manu…
As near as I can tell at the moment, it doesn't seem to respect any gemsets specified in your project .rvmrc, just the ruby interpreter specified.