Timeline for Can a Raspberry Pi be used to create a backup of itself?
Current License: CC BY-SA 3.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 21, 2019 at 21:24 | comment | added | Julian Knight | Dimitry, any code repository except one that you control tightly has risks. The larger the number of entries, the higher the risk (in general). If you want a high-security system, you have to validate everything. We ALL take risks like this every day & in general, there are enough eyes on the common repos to keep problems to a min. Not always though & there are plenty of well documented examples of repos being compromised. | |
| Jan 9, 2019 at 15:45 | comment | added | Dmitry Grigoryev |
@JulianKnight Running apt-get upgrade is just as insecure: you're telling apt to download a bunch of executables from the Internet and run them. Would you also say that the secure process is to download all packages manually, read them from top to bottom and check for insecurities?
|
|
| Oct 11, 2016 at 5:16 | history | edited | framp | CC BY-SA 3.0 |
deleted 28 characters in body
|
| Jun 16, 2016 at 17:40 | comment | added | framp | I agree with you. That's why there are two ways described how to install the script: 1. Use the installerScript 2. Download it manually, check the code and then install it manually | |
| Jun 15, 2016 at 15:02 | comment | added | Julian Knight | Just to note that delivery over HTTPS does not in any way add any security in this instance! You are still downloading and running a script from the Internet. The secure process is to download the script (http/https is irrelevant), open the script in an editor and read it top to bottom, check it for oddities and insecurities. Only when you are satisfied should you run it. Framp might be a hacker for all any of us know and delivery over https would only make him smile in that case :) (BTW, that isn't an accusation Framp!) | |
| May 9, 2016 at 17:24 | comment | added | framp | I accept your proposal. The Website is now ssl enabled and the installation script uses https. Unfortunately there is still an open issue with the http->https redirection which I will sort out the next couple of days. If you use this link you'll be safe. | |
| May 9, 2016 at 3:06 | comment | added | Clément | That would be a great step forward, yes :) | |
| May 8, 2016 at 11:01 | comment | added | framp | How do I have to publish the software so you will feel confident and safe and download it? Just use HTTPS instead of HTTP? | |
| May 7, 2016 at 21:44 | comment | added | Clément | I don't think it's off topic, and root or not doesn't matter much. The point is that software should be distributed over a secure channel, and your answer is encouraging bad security practices. | |
| May 7, 2016 at 7:36 | comment | added | framp | I see your point. But please note: Initially the user had to download raspiBackup and the sample config file manually and to copy them in /usr/local/bin and /usr/local/etc (That's why root access is required). But then I was asked by users to provide an installation script for their convenience. The instructions how to install everything manually are still there (actually the last installation option). If you want to discuss this issue in more detail feel free to comment on the webpage. I don't think this is the right place for this kind of discussion because it's offtopic. | |
| May 1, 2016 at 20:38 | comment | added | Clément | Nope, sorry: asking user to run (as root!) a script downloaded over HTTP is irresponsible. Please distribute this script over a safe channel. | |
| Dec 17, 2014 at 16:09 | history | answered | framp | CC BY-SA 3.0 |