3 ms·

Hey Tom- The installation process is short and fully documented: http://get.pow.cx/ http://get.pow.cx/ The web site and manual encourage you to read it. I th

Hey Tom- The installation process is short and fully documented: http://get.pow.cx/ http://get.pow.cx/ The web site and manual encourage you to read it. I think it's far more transparent than, say, an OS X Installer package.

tptacek 16y ago
Anyone who can run a tool to spoof DNS entries can run shell commands on machines that run this installer. Because so few people are going to install Pow relative to the population, I don't want to say this is a gigantic security problem. But the more people use this gimmick, the worse the issue gets. I think you would be doing the universe a small but meaningful favor not to advertise this installation mechanism. But it is a very cool tool and a really well-done site. Congrats!
- sstephenson 16y ago
  Just as anyone who can spoof DNS entries could swap some other theoretical Pow installer with a malicious one. I'm not seeing how Pow's installation process is any less secure than, say, downloading a disk image from a random site.
  - michaelfairley 16y ago
    Not if it's served over SSL.
    - wlll 16y ago
      This comment is a repeat, but that may not necessarily be true: http://www.imperialviolet.org/2011/03/18/revocation.html http://www.imperialviolet.org/2011/03/18/revocation.html
    - tesseract 16y ago
      That has nothing to do with whether the installer is a shell script or a binary.
- FooBarWidget 16y ago
  Anybody can also spoof DNS entries to point rubygems.org/debian.org/centos.org/redhat.com to a malicious place where the packages contain postinstall scripts that run 'rm -rf /'.
  - dpiddy 16y ago
    Maybe for rubygems, not so easy for apt/rpm as they use gpg signing/verification of package indices.
    - FooBarWidget 16y ago
      RubyGems also have signing facilities. Most authors don't bother signing however because generating a key is too much trouble.
jarin 16y ago
It might also be nice to have a Homebrew recipe, if it's possible to run it from /usr/local instead of ~/Library/Application Support (haven't dug through the code yet).

tptacek 16y ago

Anyone who can run a tool to spoof DNS entries can run shell commands on machines that run this installer. Because so few people are going to install Pow relative to the population, I don't want to say this is a gigantic security problem. But the more people use this gimmick, the worse the issue gets. I think you would be doing the universe a small but meaningful favor not to advertise this installation mechanism. But it is a very cool tool and a really well-done site. Congrats!

sstephenson 16y ago
Just as anyone who can spoof DNS entries could swap some other theoretical Pow installer with a malicious one. I'm not seeing how Pow's installation process is any less secure than, say, downloading a disk image from a random site.
- michaelfairley 16y ago
  Not if it's served over SSL.
  - wlll 16y ago
    This comment is a repeat, but that may not necessarily be true: http://www.imperialviolet.org/2011/03/18/revocation.html http://www.imperialviolet.org/2011/03/18/revocation.html
  - tesseract 16y ago
    That has nothing to do with whether the installer is a shell script or a binary.
FooBarWidget 16y ago
Anybody can also spoof DNS entries to point rubygems.org/debian.org/centos.org/redhat.com to a malicious place where the packages contain postinstall scripts that run 'rm -rf /'.
- dpiddy 16y ago
  Maybe for rubygems, not so easy for apt/rpm as they use gpg signing/verification of package indices.
  - FooBarWidget 16y ago
    RubyGems also have signing facilities. Most authors don't bother signing however because generating a key is too much trouble.

jarin 16y ago

It might also be nice to have a Homebrew recipe, if it's possible to run it from /usr/local instead of ~/Library/Application Support (haven't dug through the code yet).