3 ms·
It is worse. Notice that h2odragon didn't include "https" on purpose because of how many these install instructions do the same.
by Hitton 7y ago
It is worse. Notice that h2odragon didn't include "https" on purpose because of how many these install instructions do the same.
- jagged-chisel 7y agoDVDs also don’t implement https, and DVD images can download over http.
- zeveb 7y agoBut at least with a DVD you have the actual physical copy of what was installed, and you can examine it forensically after the fact, and you may even be able to use it as evidence of wrongdoing. You can't do that with some random file that you downloaded at some point in time (this, incidentally, is why in-browser crypto is hopelessly and forever broken).
- clarry 7y agoI can download DVD images over insecure transport and then check their signature. Not so if I'm piping code straight to shell from a http server.
- steerablesafe 7y agoI never saw a curl | bash install instruction without https.
- Hitton 7y agoYou are lucky. Last time I saw it here on HN less than week ago. When I called an author out about this I was called rude and ignorant and apparently doing so is "nasty" "especially since this is a well-known point of disagreement—not to mention well-trodden, therefore generic, therefore predictable, therefore tedious, and therefore mostly off-topic". The software in question was https://github.com/txthinking/nami https://github.com/txthinking/nami
- clarry 7y agoThe thread in question: https://news.ycombinator.com/item?id=22701891 https://news.ycombinator.com/item?id=22701891 Dang disappoints me again.