91–100 of 111 posts
> curl https://oya.sh/get | bash You lost me right there. No checksum, no digital signature - if your server gets hacked, so do your customers. Why don't you use your github releases in the installation instructions?
+1 A docker image would be much better than a random script.
Besides, this modality of installation already has precedent with Brew and Rust.
A few pointers:
- What is a "project"?
- Is Oya a language?
- What is this new Oyafile syntax?
- What actual problem is this solving?
Earlier quoted context omitted.
Since it's HTTPS, a signature or checksum are pretty pointless, TLS will do the certificate checking and encryption for you. Serving the file over HTTPS is good because it means no one can do a man in the middle attack to change it, but it's not enough to be secure. If someone compromises the server itself the file could be altered at the source. The point of the checksum is to ensure that the file you're downloading…
> If you host the file in one place and the website in a different place it's harder for an attacker to change both the file and the website that reports the checksum, ... That is not a practical solution at all . What do users find if they enter the "download" page? A link to an external site containing the checksum? Wouldn't an attacker just replace (or remove!) the link? The reality of today's identity management…
That fading animation on the homepage is super terrible.
Earlier quoted context omitted.
> If you host the file in one place and the website in a different place it's harder for an attacker to change both the file and the website that reports the checksum, ... That is not a practical solution at all . What do users find if they enter the "download" page? A link to an external site containing the checksum? Wouldn't an attacker just replace (or remove!) the link? The reality of today's identity management…
Perhaps not practical, but I could see this as one actually useful example of how a blockchain-style distributed ledger could be used. Have two accounts, one posts the binaries, another posts the checksums. That way one account breach doesn't compromise the whole thing, and the ledger could prove the history, etc.
But the fact that these solutions do not exist or at least aren't commonplace, makes the criticism to Oya in this regard rather awkward. They are doing what everybody does for their downloads: Relying on the certificate chain.
Earlier quoted context omitted.
I recall two other popular projects doing the curl xyz| bash approach Rust[0] Chef [1] And here is an old HN comment[2] going into why it doesn't really matter. Besides it's a Show HN- why be negative when we can raise the same issue more constructively as "Please add checksums and digital signatures. Also why not use regular GitHub releases in the installation instructions?" [0] https://doc.rust-lang.org/book/ch01-0…
RVM requires GPG keys which is the way to do it properly: https://rvm.io/
Quoting a testimonial on the website by the co-founder of Tooploox is not really a thing, right? Tooploox is the creator of Oya.
It was created as an independent open source project, then used internally @ Tooploox, then development got sponsored by Tooploox so it does make sense from our (very subjective) pov. But I agree AFTER it got moved to Tooploox Github it looks kinda self-serving.
Earlier quoted context omitted.
+1 A docker image would be much better than a random script.
Why? Then you have to run the whole thing in Docker. That's a wholly unnecessary extra dependency. Besides, this modality of installation already has precedent with Brew and Rust.
Or you use docker.
Not entirely sure if a standalone script with no versioning is the best way to do this in day and age.