This is a great web page, but I think it's borderline irresponsible to keep using this gimmick:
curl get.pow.cx | sh
for installation. Yes, it's easy and slick. Yes, you'd have to read the code itself to make sure Pow didn't own your machine up after a secure install. Yes, you can just read the shell script. But 0.0001% of people playing with Pow will do that. Why make things easier for attackers at all?
This is an idea that I think started with Ximian back in 2000 and I think we're ready for it to die. It'd be neat if the authors of Pow were cool enough to strike it from their (otherwise amazing) front page.
(I'd also be happier if the thread where the guy explains how Pow works and what it's components are were voted higher than this comment.)
This is an idea that I think started with Ximian back in 2000 and I think we're ready for it to die. It'd be neat if the authors of Pow were cool enough to strike it from their (otherwise amazing) front page.
(I'd also be happier if the thread where the guy explains how Pow works and what it's components are were voted higher than this comment.)