3 ms·

I got down to you should be able to install PCP from binary packages made available by the PCP development team on: ftp.pcp.io and that threw up a r

I got down to you should be able to install PCP from binary packages made available by the PCP development team on: ftp.pcp.io and that threw up a red flag in my brain. Then I noticed that techblog.netflix.com doesn't redirect to https (and indeed can't serve https) (I use https://www.eff.org/HTTPS-EVERYWHERE https://www.eff.org/HTTPS-EVERYWHERE and did not get content over https). The directions _I_ saw for building from source looked pretty innocuous, but you might see a different set of directions if you're being MITMed. Observe an appropriate amount of caution.

mspier 12y ago
Happy to discuss your concerns. PCP 3.10 should be available on Ubuntu's official repo pretty soon too.
- harshreality 12y ago
  His concerns seem plain to me. Unauthenticated channels for software distribution or software installation instructions are bad. The techblog isn't using SSL, and the git pull url for PCP is using the git protocol which is also unauthenticated, rather than the authenticated https transport (ssh is only an option when user accounts make sense). Someone's at a conference and follows the link over public wifi. They get the same page but with "here's how to get PCP: ftp evil.io or git clone git://git.evil.io/pcp" Even if the webpage were ssl-enabled so that an attacker can't rewrite the pcp.io links, an attacker or evil network operator could MITM git.pcp.io or ftp.pcp.io. (FTP?!) Being in Ubuntu's repo doesn't make it safe if Ubuntu's maintainers have no (semi-)trustworthy way of getting the code.
  - justizin 12y ago
    Ubuntu's maintainers can check the MD5SUM file on ftp.pcp.io: ftp://ftp.pcp.io/projects/pcp/download/MD5SUM The project seems to be hosted by Red Hat these days.
    - willglynn 12y ago
      FTP is just as unauthenticated as everything else above, so having MD5SUMs available over FTP doesn't really change the situation.
- mrmondo 12y ago
  Any chance you could provide standard Debian builds rather than Ubuntu specific?
nathan_scott 12y ago
To get the sources, you can use non-ftp/non-git access methods via the github mirror - https://github.com/performancecopilot/pcp https://github.com/performancecopilot/pcp

mspier 12y ago

Happy to discuss your concerns. PCP 3.10 should be available on Ubuntu's official repo pretty soon too.

harshreality 12y ago
His concerns seem plain to me. Unauthenticated channels for software distribution or software installation instructions are bad. The techblog isn't using SSL, and the git pull url for PCP is using the git protocol which is also unauthenticated, rather than the authenticated https transport (ssh is only an option when user accounts make sense). Someone's at a conference and follows the link over public wifi. They get the same page but with "here's how to get PCP: ftp evil.io or git clone git://git.evil.io/pcp" Even if the webpage were ssl-enabled so that an attacker can't rewrite the pcp.io links, an attacker or evil network operator could MITM git.pcp.io or ftp.pcp.io. (FTP?!) Being in Ubuntu's repo doesn't make it safe if Ubuntu's maintainers have no (semi-)trustworthy way of getting the code.
- justizin 12y ago
  Ubuntu's maintainers can check the MD5SUM file on ftp.pcp.io: ftp://ftp.pcp.io/projects/pcp/download/MD5SUM The project seems to be hosted by Red Hat these days.
  - willglynn 12y ago
    FTP is just as unauthenticated as everything else above, so having MD5SUMs available over FTP doesn't really change the situation.
mrmondo 12y ago
Any chance you could provide standard Debian builds rather than Ubuntu specific?

nathan_scott 12y ago

To get the sources, you can use non-ftp/non-git access methods via the github mirror - https://github.com/performancecopilot/pcp https://github.com/performancecopilot/pcp