4 ms·

On one hand, as big Scala fan, this is great, I love the IO library! On the other hand, I hate to be that guy, but 1. website is not https, no guarantee it's

On one hand, as big Scala fan, this is great, I love the IO library! On the other hand, I hate to be that guy, but 1. website is not https, no guarantee it's not modified or any authenticity 2. to install I need to download a file from a shorten URL then make it executable, then run it, no questions asked. I'm sorry but no. 3. no checksum to validate the binary Great start, but these small security things are going to inhibit adoption, at least in my case. Still don't let that stop you. Better ship early than never, and it looks very polished and well thought. Good luck!

memracom 9y ago
There is a github repo. Clone it and build it, after all you are a developer, right? If you want to run Ammonite on Windows the only way is to clone the repo, patch it and build it. You are right to be careful, even paranoid, but the security issues are not a showstopper.
- eranation 9y ago
  Not a show stopper, but will make it less likely people will spend the time trying it out. If things like "brew install x" were not important, it wouldn't had 7000 stars on github and used by almost any Mac developer. Yes, we can build all from source... but how many of us prefer doing it over using a trusted package manager? Ammonite is about developer productivity, or so I believe, so having to clone and build it from source is not going to increase the amount of people trying it out... part of shipping is security, and security should be there from the get go, it's not something you just add later.
  - lihaoyi 9y ago
    You can `brew install ammonite` too https://github.com/Homebrew/homebrew-core/blob/master/Formula/ammonite-repl.rb https://github.com/Homebrew/homebrew-core/blob/master/Formul...
- godmodus 9y ago
  Its amazing for anything internal, I import it using sbt/ivy and load the console/run an ssh session!
manojlds 9y ago
The website having to be https is a bit too much. It is hosted on gh-pages and there is no way to get https with custom domain (without things like Cloudflare)
- eranation 9y ago
  Cloudflair https is free, (https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/) and not such a big of a pain to setup. without https, let's say someone puts a wifi hotspot named JFK_AIRPORT_FREE_WIFI in the airport, and plays with the DNS setting and points to his own version of the internet. https websites are more or less protected from these as the certificates will not be valid. http ones are completely open to manipulation. Do you lock your door at night? even though most likely no one will come in? Do you look who is at the door before opening it? Why is expecting https is a bit too much? Why is security something people see as "we can add it later when needed". It should be part of the checklist before releasing. Most people won't release without documentation, a decent automated build, some unit tests, right? Security should be way up that list as well. Another reason is showing you mind about security. Getting https is just one step, making sure the code is secure is a whole different topic. If you don't care about https, how do I know (without reading the code) that you care about not using DES, that you care about hashing + salting your passwords, that you care about not logging sensitive information, that you don't run as root when not needed, that you take care of my data and not compromise it. It starts with "meh, https is a bit too much" and ends up with Linkedin passwords leaking because they just hashed it. This is not cooking. You can't always add salt later. </rant>
  - manojlds 9y ago
    All that is fine - for a simple static site with no user information and hosted on gh-pages - using that as a point to not try a open source project is not right.
    - michaelmior 9y ago
      Why is it "not right"? Can't I be as paranoid as I want when it comes to what I install on my machine? Of course the OP has no obligation to fix this, but I think the parent was just pointing out a legitimate barrier that is worth considering.

memracom 9y ago

There is a github repo. Clone it and build it, after all you are a developer, right? If you want to run Ammonite on Windows the only way is to clone the repo, patch it and build it. You are right to be careful, even paranoid, but the security issues are not a showstopper.

eranation 9y ago
Not a show stopper, but will make it less likely people will spend the time trying it out. If things like "brew install x" were not important, it wouldn't had 7000 stars on github and used by almost any Mac developer. Yes, we can build all from source... but how many of us prefer doing it over using a trusted package manager? Ammonite is about developer productivity, or so I believe, so having to clone and build it from source is not going to increase the amount of people trying it out... part of shipping is security, and security should be there from the get go, it's not something you just add later.
- lihaoyi 9y ago
  You can `brew install ammonite` too https://github.com/Homebrew/homebrew-core/blob/master/Formula/ammonite-repl.rb https://github.com/Homebrew/homebrew-core/blob/master/Formul...
godmodus 9y ago
Its amazing for anything internal, I import it using sbt/ivy and load the console/run an ssh session!

manojlds 9y ago

The website having to be https is a bit too much. It is hosted on gh-pages and there is no way to get https with custom domain (without things like Cloudflare)

eranation 9y ago
Cloudflair https is free, (https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/) and not such a big of a pain to setup. without https, let's say someone puts a wifi hotspot named JFK_AIRPORT_FREE_WIFI in the airport, and plays with the DNS setting and points to his own version of the internet. https websites are more or less protected from these as the certificates will not be valid. http ones are completely open to manipulation. Do you lock your door at night? even though most likely no one will come in? Do you look who is at the door before opening it? Why is expecting https is a bit too much? Why is security something people see as "we can add it later when needed". It should be part of the checklist before releasing. Most people won't release without documentation, a decent automated build, some unit tests, right? Security should be way up that list as well. Another reason is showing you mind about security. Getting https is just one step, making sure the code is secure is a whole different topic. If you don't care about https, how do I know (without reading the code) that you care about not using DES, that you care about hashing + salting your passwords, that you care about not logging sensitive information, that you don't run as root when not needed, that you take care of my data and not compromise it. It starts with "meh, https is a bit too much" and ends up with Linkedin passwords leaking because they just hashed it. This is not cooking. You can't always add salt later. </rant>
- manojlds 9y ago
  All that is fine - for a simple static site with no user information and hosted on gh-pages - using that as a point to not try a open source project is not right.
  - michaelmior 9y ago
    Why is it "not right"? Can't I be as paranoid as I want when it comes to what I install on my machine? Of course the OP has no obligation to fix this, but I think the parent was just pointing out a legitimate barrier that is worth considering.