Hi team,
I'm setting up a Dyno labelmanager on a Mac, and I've noticed the script /Applications/DYMO.WebApi.Mac.Host.app/Contents/Resources/InstallCertificates.sh wants to run during the install. Aside from the obvious - that it's bad to normalise to users they should type in their password in a terminal they don't understand - the root certificate is of concern. as part of the script:
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/dymolocal.cer
Digging deeper, it appears you're attempting to run some local web service on my machine, without actually going over the detail of this with me as a user. This is really bad practice and running random ASP.Net services listening on unexpected ports on peoples systems is almost definitely eventually going to lead to some level of exploit, privilege escalation, etc.
Can you please stop adding your own root CAs to peoples computers and running local webservers? I feel like that sentence shouldn't need to be said. This is production software you're putting out to users not local dev, please think about your actions.
Hi team,
I'm setting up a Dyno labelmanager on a Mac, and I've noticed the script
/Applications/DYMO.WebApi.Mac.Host.app/Contents/Resources/InstallCertificates.shwants to run during the install. Aside from the obvious - that it's bad to normalise to users they should type in their password in a terminal they don't understand - the root certificate is of concern. as part of the script:Digging deeper, it appears you're attempting to run some local web service on my machine, without actually going over the detail of this with me as a user. This is really bad practice and running random ASP.Net services listening on unexpected ports on peoples systems is almost definitely eventually going to lead to some level of exploit, privilege escalation, etc.
Can you please stop adding your own root CAs to peoples computers and running local webservers? I feel like that sentence shouldn't need to be said. This is production software you're putting out to users not local dev, please think about your actions.