3 ms·

This project looks great, but I find the comparison point "How easy to install?" to be very misleading. It says that prettyping is easier to install than the al

by vog 11y ago

This project looks great, but I find the comparison point "How easy to install?" to be very misleading. It says that prettyping is easier to install than the alternatives, but all mentioned alternatives are all readily available as packages for your distro. Also, I prefer installing via the package manager because of the integrity check. To do the same with the "curl" approach, I have to donwload the code, import the developer's GPG key, download the signature and run GPG ... Oh wait, there is no signature file for Prettyping. Not even the Git tag "v1.0.0" is signed. So I have to download from multiple sources, or email the author and ask for the expected hash value. This process is much easier if prettyping was included in the distros. So the other tools are actually better off with regard to "How easy to install?" I wish the project site would be more honest in that regard, or at least add another comparison point "How easy to install _safely_?"

denilsonsa 11y ago
I'm the author. Sorry about the lack of signature, I'm not well versed in GPG. Also, I suppose the man-in-the-middle issue is mitigated by downloading directly from GitHub over https. Unless there is something else I'm missing (very likely, feel free to enlighten me). Sure, I'd love to have it packaged on several distributions (I know Arch Linux already has it; and also brew on Mac OS X), but I can't do it myself. I hope users from other distros find it useful and contribute packages to their distros. Still, I wrote that comparison with good faith and based on my own experience. For instance, I once wanted to run it on a university computer that only gave me normal user access. I couldn't install anything outside my home directory, and I couldn't rely on package management. "How easy to install?" could be renamed to "How easy to install from scratch?", because everything is essentially trivial to install using a package manager.
- vog 11y ago
  > Also, I suppose the man-in-the-middle issue is mitigated by downloading directly from GitHub over https. Unless there is something else I'm missing (very likely, feel free to enlighten me). There is no substitute for end-to-end encryption, from you, the author, to me, the user. The only generally accepted relaxation is end-to-encryption from the maintainer (e.g. Debian maintainer) to the user - which is what you have in the distros. Compared to those best practices, the "HTTPS from GitHub" has the following flaws: 1) You have to trust GitHub. If GitHub is hacked, or starts to behave like SourceForge, you are doomed and nobody will notice. 2) Unless all of your users do certificate-pinning, a compromised CA (or a malicious CA) may be used to issue an alternative SSL certificate for GitHub, which is then used to deliver malware. It may seem implausible that anyone would go that long way to attack your prettyping project directly. However, it is very attractive to attack GitHub as a whole and to manipulate all hosted programs systematically. > Sure, I'd love to have it packaged on several distributions (...), but I can't do it myself. I hope users from other distros find it useful and contribute packages to their distros. Maybe it helps to ask them. I know that Debian has a mailing list for that. Sure, you still need to find volunteers if you can't do the packaging on your own. But maybe there are people willing to do that, who just need a little more motivation. > "How easy to install from scratch?" Agreed, that would be a much better wording.

by vog 11y ago

denilsonsa 11y ago

I'm the author. Sorry about the lack of signature, I'm not well versed in GPG. Also, I suppose the man-in-the-middle issue is mitigated by downloading directly from GitHub over https. Unless there is something else I'm missing (very likely, feel free to enlighten me). Sure, I'd love to have it packaged on several distributions (I know Arch Linux already has it; and also brew on Mac OS X), but I can't do it myself. I hope users from other distros find it useful and contribute packages to their distros. Still, I wrote that comparison with good faith and based on my own experience. For instance, I once wanted to run it on a university computer that only gave me normal user access. I couldn't install anything outside my home directory, and I couldn't rely on package management. "How easy to install?" could be renamed to "How easy to install from scratch?", because everything is essentially trivial to install using a package manager.

vog 11y ago
> Also, I suppose the man-in-the-middle issue is mitigated by downloading directly from GitHub over https. Unless there is something else I'm missing (very likely, feel free to enlighten me). There is no substitute for end-to-end encryption, from you, the author, to me, the user. The only generally accepted relaxation is end-to-encryption from the maintainer (e.g. Debian maintainer) to the user - which is what you have in the distros. Compared to those best practices, the "HTTPS from GitHub" has the following flaws: 1) You have to trust GitHub. If GitHub is hacked, or starts to behave like SourceForge, you are doomed and nobody will notice. 2) Unless all of your users do certificate-pinning, a compromised CA (or a malicious CA) may be used to issue an alternative SSL certificate for GitHub, which is then used to deliver malware. It may seem implausible that anyone would go that long way to attack your prettyping project directly. However, it is very attractive to attack GitHub as a whole and to manipulate all hosted programs systematically. > Sure, I'd love to have it packaged on several distributions (...), but I can't do it myself. I hope users from other distros find it useful and contribute packages to their distros. Maybe it helps to ask them. I know that Debian has a mailing list for that. Sure, you still need to find volunteers if you can't do the packaging on your own. But maybe there are people willing to do that, who just need a little more motivation. > "How easy to install from scratch?" Agreed, that would be a much better wording.