4 ms·
"curl http://get.docker.io http://get.docker.io | sh" - what reason would there be to not use SSL here?
by lreeves 13y ago
"curl http://get.docker.io http://get.docker.io | sh" - what reason would there be to not use SSL here?
- nickstinemates 13y agohttps is not available for the site. The script doesn't seem particularly sensitive, is it?
- adamonduty 13y agoSo that someone between you and http://get.docker.io http://get.docker.io doesn't decide to replace the script with their own special version that runs as root on your box.
- lreeves 13y agoSorry, I realize that. I mean, you're asking people to literally pipe data into their shell from a website and you're not using HTTPS. That seems lax to me.
- shykes 13y agoThere's an ongoing issue for this [1]. The script is currently hosted on an S3 bucket which doesn't support SSL access via the CNAME. We're migrating it to a separate server. [1] https://github.com/dotcloud/docker/pull/648 https://github.com/dotcloud/docker/pull/648