Introducing Vector: Netflix's On-Host Performance Monitoring Tool

Re:Introducing Vector: Netflix's On-Host Performance Monitor... by philsnow on Wednesday April 08, 2015 @12:32PM (#9341940)

I got down to

     you should be able to install PCP from binary packages made available by the PCP development team on:

    ftp.pcp.io

and that threw up a red flag in my brain. Then I noticed that techblog.netflix.com doesn't redirect to https (and indeed can't serve https) (I use https://www.eff.org/HTTPS-EVERYWHERE and did not get content over https).

The directions _I_ saw for building from source looked pretty innocuous, but you might see a different set of directions if you're being MITMed. Observe an appropriate amount of caution.

[ Parent | on HN ]

Re:Introducing Vector: Netflix's On-Host Performance Monitor... by mspier on Wednesday April 08, 2015 @12:40PM (#9342008)

Happy to discuss your concerns. PCP 3.10 should be available on Ubuntu's official repo pretty soon too.

[ Parent | on HN ]

Re:Introducing Vector: Netflix's On-Host Performance Monitor... by harshreality on Wednesday April 08, 2015 @04:12PM (#9343572)

His concerns seem plain to me. Unauthenticated channels for software distribution or software installation instructions are bad.

The techblog isn't using SSL, and the git pull url for PCP is using the git protocol which is also unauthenticated, rather than the authenticated https transport (ssh is only an option when user accounts make sense).

Someone's at a conference and follows the link over public wifi. They get the same page but with "here's how to get PCP: ftp evil.io or git clone git://git.evil.io/pcp" Even if the webpage were ssl-enabled so that an attacker can't rewrite the pcp.io links, an attacker or evil network operator could MITM git.pcp.io or ftp.pcp.io. (FTP?!)

Being in Ubuntu's repo doesn't make it safe if Ubuntu's maintainers have no (semi-)trustworthy way of getting the code.

[ Parent | on HN ]

Re:Introducing Vector: Netflix's On-Host Performance Monitor... by justizin on Wednesday April 08, 2015 @06:17PM (#9344464)

Ubuntu's maintainers can check the MD5SUM file on ftp.pcp.io:

  ftp://ftp.pcp.io/projects/pcp/download/MD5SUM

The project seems to be hosted by Red Hat these days.

[ Parent | on HN ]

Re:Introducing Vector: Netflix's On-Host Performance Monitor... by willglynn on Wednesday April 08, 2015 @08:08PM (#9345016)

FTP is just as unauthenticated as everything else above, so having MD5SUMs available over FTP doesn't really change the situation.

[ Parent | on HN ]

Re:Introducing Vector: Netflix's On-Host Performance Monitor... by mrmondo on Thursday April 09, 2015 @06:13AM (#9346608)

Any chance you could provide standard Debian builds rather than Ubuntu specific?

[ Parent | on HN ]

Re:Introducing Vector: Netflix's On-Host Performance Monitor... by nathan_scott on Thursday April 09, 2015 @09:53PM (#9352157)

To get the sources, you can use non-ftp/non-git access methods via the github mirror - https://github.com/performancecopilot/pcp

[ Parent | on HN ]