News for hackers. Stuff that matters.

A comment on 21: An Open Source Library for the Machine-Payable Web. Parent comment

Re:21: An Open Source Library for the Machine-Payable Web by witty_username on Saturday June 11, 2016 @11:56AM (#11883896)
> In addition, the "curl | sh" type of installation has a bad reputation among developers, for security reasons. Which is especially critical when payment is involved. And which is even more critical when it is about automatic payment.

It's through HTTPS, so it's secure.

[ Parent | on HN ]
Re:21: An Open Source Library for the Machine-Payable Web by SkyMarshal on Saturday June 11, 2016 @12:23PM (#11884019)
That only secures the transport, not necessarily the source. Especially without a checksum or digital sig to verify the source, it's a little weird of an oversight for a company like 21.
[ Parent | on HN ]
Re:21: An Open Source Library for the Machine-Payable Web by witty_username on Sunday June 12, 2016 @04:42AM (#11887252)
How would that checksum or digital signature be distributed?

HTTPS checks for authenticity of source (it uses digital signatures). Now, I guess there could be a rogue CA which creates another certificate for 21.co, but excluding that it's fine.

[ Parent | on HN ]
Re:21: An Open Source Library for the Machine-Payable Web by sysadminkyle on Saturday June 11, 2016 @01:05PM (#11884224)
woosh
[ Parent | on HN ]