Anyone who can run a tool to spoof DNS entries can run shell commands on machines that run this installer. Because so few people are going to install Pow relative to the population, I don't want to say this is a gigantic security problem. But the more people use this gimmick, the worse the issue gets.
I think you would be doing the universe a small but meaningful favor not to advertise this installation mechanism.
But it is a very cool tool and a really well-done site. Congrats!
Anybody can also spoof DNS entries to point rubygems.org/debian.org/centos.org/redhat.com to a malicious place where the packages contain postinstall scripts that run 'rm -rf /'.
It might also be nice to have a Homebrew recipe, if it's possible to run it from /usr/local instead of ~/Library/Application Support (haven't dug through the code yet).
Comments
Hey Tom-
The installation process is short and fully documented: http://get.pow.cx/
The web site and manual encourage you to read it.
I think it's far more transparent than, say, an OS X Installer package.
Anyone who can run a tool to spoof DNS entries can run shell commands on machines that run this installer. Because so few people are going to install Pow relative to the population, I don't want to say this is a gigantic security problem. But the more people use this gimmick, the worse the issue gets.
I think you would be doing the universe a small but meaningful favor not to advertise this installation mechanism.
But it is a very cool tool and a really well-done site. Congrats!
Just as anyone who can spoof DNS entries could swap some other theoretical Pow installer with a malicious one.
I'm not seeing how Pow's installation process is any less secure than, say, downloading a disk image from a random site.
Not if it's served over SSL.
That has nothing to do with whether the installer is a shell script or a binary.
This comment is a repeat, but that may not necessarily be true:
http://www.imperialviolet.org/2011/03/18/revocation.html
Anybody can also spoof DNS entries to point rubygems.org/debian.org/centos.org/redhat.com to a malicious place where the packages contain postinstall scripts that run 'rm -rf /'.
Maybe for rubygems, not so easy for apt/rpm as they use gpg signing/verification of package indices.
RubyGems also have signing facilities. Most authors don't bother signing however because generating a key is too much trouble.
It might also be nice to have a Homebrew recipe, if it's possible to run it from /usr/local instead of ~/Library/Application Support (haven't dug through the code yet).