4 ms·

I'm the author. Sorry about the lack of signature, I'm not well versed in GPG. Also, I suppose the man-in-the-middle issue is mitigated by downloading directly

I'm the author. Sorry about the lack of signature, I'm not well versed in GPG. Also, I suppose the man-in-the-middle issue is mitigated by downloading directly from GitHub over https. Unless there is something else I'm missing (very likely, feel free to enlighten me). Sure, I'd love to have it packaged on several distributions (I know Arch Linux already has it; and also brew on Mac OS X), but I can't do it myself. I hope users from other distros find it useful and contribute packages to their distros. Still, I wrote that comparison with good faith and based on my own experience. For instance, I once wanted to run it on a university computer that only gave me normal user access. I couldn't install anything outside my home directory, and I couldn't rely on package management. "How easy to install?" could be renamed to "How easy to install from scratch?", because everything is essentially trivial to install using a package manager.

vog 11y ago
> Also, I suppose the man-in-the-middle issue is mitigated by downloading directly from GitHub over https. Unless there is something else I'm missing (very likely, feel free to enlighten me). There is no substitute for end-to-end encryption, from you, the author, to me, the user. The only generally accepted relaxation is end-to-encryption from the maintainer (e.g. Debian maintainer) to the user - which is what you have in the distros. Compared to those best practices, the "HTTPS from GitHub" has the following flaws: 1) You have to trust GitHub. If GitHub is hacked, or starts to behave like SourceForge, you are doomed and nobody will notice. 2) Unless all of your users do certificate-pinning, a compromised CA (or a malicious CA) may be used to issue an alternative SSL certificate for GitHub, which is then used to deliver malware. It may seem implausible that anyone would go that long way to attack your prettyping project directly. However, it is very attractive to attack GitHub as a whole and to manipulate all hosted programs systematically. > Sure, I'd love to have it packaged on several distributions (...), but I can't do it myself. I hope users from other distros find it useful and contribute packages to their distros. Maybe it helps to ask them. I know that Debian has a mailing list for that. Sure, you still need to find volunteers if you can't do the packaging on your own. But maybe there are people willing to do that, who just need a little more motivation. > "How easy to install from scratch?" Agreed, that would be a much better wording.

vog 11y ago

> Also, I suppose the man-in-the-middle issue is mitigated by downloading directly from GitHub over https. Unless there is something else I'm missing (very likely, feel free to enlighten me). There is no substitute for end-to-end encryption, from you, the author, to me, the user. The only generally accepted relaxation is end-to-encryption from the maintainer (e.g. Debian maintainer) to the user - which is what you have in the distros. Compared to those best practices, the "HTTPS from GitHub" has the following flaws: 1) You have to trust GitHub. If GitHub is hacked, or starts to behave like SourceForge, you are doomed and nobody will notice. 2) Unless all of your users do certificate-pinning, a compromised CA (or a malicious CA) may be used to issue an alternative SSL certificate for GitHub, which is then used to deliver malware. It may seem implausible that anyone would go that long way to attack your prettyping project directly. However, it is very attractive to attack GitHub as a whole and to manipulate all hosted programs systematically. > Sure, I'd love to have it packaged on several distributions (...), but I can't do it myself. I hope users from other distros find it useful and contribute packages to their distros. Maybe it helps to ask them. I know that Debian has a mailing list for that. Sure, you still need to find volunteers if you can't do the packaging on your own. But maybe there are people willing to do that, who just need a little more motivation. > "How easy to install from scratch?" Agreed, that would be a much better wording.