News for hackers. Stuff that matters.

A comment on Alcatraz – Package manager for Xcode 5. Parent comment

Re:Alcatraz – Package manager for Xcode 5 by teacup50 on Monday March 03, 2014 @09:11PM (#7338013)
Why does this link need to be shortened at all?
[ Parent | on HN ]
Re:Alcatraz – Package manager for Xcode 5 by mneorr on Monday March 03, 2014 @09:48PM (#7338123)
Since the original one is really long; would make the install script even less readable.

Also, git.io allows only shortening github repos; so there should be no harm

[ Parent | on HN ]
Re:Alcatraz – Package manager for Xcode 5 by teacup50 on Tuesday March 04, 2014 @12:03AM (#7338575)
> Since the original one is really long; would make the install script even less readable.

Really?

Who do you think your target audience is? I'm sorry, but this is not "really long":

    https://github.com/supermarin/Alcatraz/releases/download/1.0.1/Alcatraz.tar.gz
If you're telling people to run random commands in their terminal that lead to local code execution, then you should trust that they can read a goddamn URL.

If you don't think your user base can read URLs, then you shouldn't be telling them to launch the terminal and run your code.

[ Parent | on HN ]
Re:Alcatraz – Package manager for Xcode 5 by Argorak on Tuesday March 04, 2014 @01:16AM (#7338805)
You are providing an HTTP link to git.io, so it cannot be verified whether I am connecting to the real git.io. This means an attacker can fake himself being git.io very easily (a classic man-in-the-middle attack).

It doesn't matter if git.io can only shorten git urls, as git.io will never be involved in a potential attack.

Using a link shortener is okay, but use one that supports HTTPS.

[ Parent | on HN ]