6 ms·

Frenches don't really worry about that, they are already building the next generation of personal cloud ;) http://cozy.io http://cozy.io

by gelnior 13y ago

k-mcgrady 13y ago
First time I've seen cozy. Looks quite useful.
- Create 13y ago
  http://owncloud.org/ http://owncloud.org/
pgeorgi 13y ago
I find it hard to take a security related project seriously that installs with: $ curl http://cozy.io/install_cozy.sh http://cozy.io/install_cozy.sh | HOST=root@ip sh # sudoer required Edit: even more annoying is that this script is only supposed to run on Debian/Ubuntu - so this script isn't even any more portable than .deb packages Edit2 to be more constructive: would you accept contributions to build packages? Apart from this annoyance the project looks interesting!
- gelnior 13y ago
  How do you install new stuff on your machine without super user rights ? Do you have a specific user to run apt-get ?
  - ihsw 13y ago
    I think it might have to do with http vs https.
  - colanderman 13y ago
    apt-get doesn't run unsigned, unvetted shell scripts downloaded over unprotected channels.
    - gelnior 13y ago
      About the signing part, we definitely have to improve that. Thank you for mentioning. About the channel, the (real) install script is based on Fabric and use SSH. So you can refer directly to this: http://cozy.io/host/install.html http://cozy.io/host/install.html
      - afreak 13y ago
        You also should be using HTTPS for these sort of situations. Not that what you are suggesting is good in the first place.
  - pgeorgi 13y ago
    Signed packages have at least two advantages: 1. they can be signed 2. they can be analyzed (also at a later date if you keep them around) to figure out if any "mis-feature" was added after the fact or came from upstream. Those scripts typically download all kinds of other things during the installation.
    - gelnior 13y ago
      Thank you for your feedback, we'll fix that. I open an issue about it.
- mikeash 13y ago
  It would be fun to build a list of projects that install this way, then build a tool that sits on open WiFi networks and automatically tacks on a "fun" payload whenever it sees someone request one of these scripts.
- gelnior 13y ago
  > to be more constructive: would you accept contributions to build packages? Apart from this annoyance the project looks interesting! Of course any contribution of this kind is greatly appreciated !

Frenches don't really worry about that, they are already building the next generation of personal cloud ;) http://cozy.io http://cozy.io

by gelnior 13y ago

Frenches don't really worry about that, they are already building the next generation of personal cloud ;) http://cozy.io http://cozy.io

k-mcgrady 13y ago

First time I've seen cozy. Looks quite useful.

Create 13y ago
http://owncloud.org/ http://owncloud.org/

pgeorgi 13y ago

I find it hard to take a security related project seriously that installs with: $ curl http://cozy.io/install_cozy.sh http://cozy.io/install_cozy.sh | HOST=root@ip sh # sudoer required Edit: even more annoying is that this script is only supposed to run on Debian/Ubuntu - so this script isn't even any more portable than .deb packages Edit2 to be more constructive: would you accept contributions to build packages? Apart from this annoyance the project looks interesting!

gelnior 13y ago
How do you install new stuff on your machine without super user rights ? Do you have a specific user to run apt-get ?
- ihsw 13y ago
  I think it might have to do with http vs https.
- colanderman 13y ago
  apt-get doesn't run unsigned, unvetted shell scripts downloaded over unprotected channels.
  - gelnior 13y ago
    About the signing part, we definitely have to improve that. Thank you for mentioning. About the channel, the (real) install script is based on Fabric and use SSH. So you can refer directly to this: http://cozy.io/host/install.html http://cozy.io/host/install.html
    - afreak 13y ago
      You also should be using HTTPS for these sort of situations. Not that what you are suggesting is good in the first place.
- pgeorgi 13y ago
  Signed packages have at least two advantages: 1. they can be signed 2. they can be analyzed (also at a later date if you keep them around) to figure out if any "mis-feature" was added after the fact or came from upstream. Those scripts typically download all kinds of other things during the installation.
  - gelnior 13y ago
    Thank you for your feedback, we'll fix that. I open an issue about it.
mikeash 13y ago
It would be fun to build a list of projects that install this way, then build a tool that sits on open WiFi networks and automatically tacks on a "fun" payload whenever it sees someone request one of these scripts.
gelnior 13y ago
> to be more constructive: would you accept contributions to build packages? Apart from this annoyance the project looks interesting! Of course any contribution of this kind is greatly appreciated !