[security] Install via http(s)

CenturyLinkLabs / panamax-ui

The Web GUI for Panamax

http://panamax.io

Apache License 2.0

1.44k stars 151 forks source link

[security] Install via http(s) #323

Open benmccann opened 10 years ago

benmccann commented 10 years ago

There really should be a better way to install Panamax than curl http://download.panamax.io/installer/ubuntu.sh | bash. Because it is served over HTTP, an attacker can get you to install malicious software by swapping out the Panamax installer script with their own. I'd really like to see Panamax offer https download as installing any software over http is not a great idea.

cakkineni commented 10 years ago

Hi @benmccann

Thanks for your suggestion. Right now we are not setup for https. Once we are setup, we will change the way downloads happen.

Chaitanya.

todd-a-jacobs commented 8 years ago

+1 for this bug. A number of my clients won't even look at this project because it can't be retrieved from a secure URI, and there doesn't appear to be any out-of-band cryptographic signature to verify insecure downloads.