4 ms·

Very droll indeed. I don't use homebrew so I don't know how is it managed, but I have generally believe Debian maintainers to be more credible than random githu

by Hitton 7y ago

Very droll indeed. I don't use homebrew so I don't know how is it managed, but I have generally believe Debian maintainers to be more credible than random github user. When I see install instructions like these I always at least skim the instal script before running it. And of course Debian packages are signed unlike downloading script from unsecured website like in this case where you risk MitM attack.

ManWith2Plans 7y ago
From the documentation: > Nami is a decentralized binary package manager, she allows software authors to publish their software anywhere, without having to request a merge from a software center for each update. If you're trying to install a decentralized binary package manager which doesn't require maintainers to merge anything, you're presumably planning on taking far greater risks than curling this installer.
txthinking 7y ago
MitM? Why are you so ignorant? Just google git.io? Just google http 301?
- Hitton 7y ago
  I didn't expect that I'll have to explain how does internet work, but ok. When you ask curl to download "git.io/getnami", first thing it does is to ask DNS server: "Hey, what IP does git.io refer to?" And DNS server will send you the IP address. MitM attack can happen at this point, and you will get fraudulent IP address. Usually you will get correct one. Then you connect to the IP address. MitM attack can happen here as well, you think you connected to server with the IP, but some node along the way is actually lying to you and you are in fact connecting somewhere else. At this point when using https, webserver to which you connected would prove to you that it is indeed "git.io" and your communication would become encrypted. Only after that would the webserver 301 redirected you somewhere else. But because you chose to not use https, user might have connected somewhere else and could have downloaded completely different, malicious file. Next time you accuse other people of being ignorant and rude, make sure it's not you who is in the wrong.

by Hitton 7y ago

ManWith2Plans 7y ago

From the documentation: > Nami is a decentralized binary package manager, she allows software authors to publish their software anywhere, without having to request a merge from a software center for each update. If you're trying to install a decentralized binary package manager which doesn't require maintainers to merge anything, you're presumably planning on taking far greater risks than curling this installer.

txthinking 7y ago

MitM? Why are you so ignorant? Just google git.io? Just google http 301?

Hitton 7y ago
I didn't expect that I'll have to explain how does internet work, but ok. When you ask curl to download "git.io/getnami", first thing it does is to ask DNS server: "Hey, what IP does git.io refer to?" And DNS server will send you the IP address. MitM attack can happen at this point, and you will get fraudulent IP address. Usually you will get correct one. Then you connect to the IP address. MitM attack can happen here as well, you think you connected to server with the IP, but some node along the way is actually lying to you and you are in fact connecting somewhere else. At this point when using https, webserver to which you connected would prove to you that it is indeed "git.io" and your communication would become encrypted. Only after that would the webserver 301 redirected you somewhere else. But because you chose to not use https, user might have connected somewhere else and could have downloaded completely different, malicious file. Next time you accuse other people of being ignorant and rude, make sure it's not you who is in the wrong.