4 ms·

>It's $100 for the signing and $500 for a Mac Mini. Any professional software developer would make that kind of money in a few days Sorry but you are living in

>It's $100 for the signing and $500 for a Mac Mini. Any professional software developer would make that kind of money in a few days Sorry but you are living in a bubble. There are thousands of software professionals who don't make that kind of money in India, South America and many other places.

CamperBob2 9y ago
If the author of Handbrake is one of them, that can hardly be construed as the users' fault. Run some Google ads or something.
- rglullis 9y ago
  Or you know, don't be a entitled jerk of an user who can't be bothered to support Free (as in Speech, NOT as in beer) Software. Come on, if every developer that uses any kind of Free Software decided to donate every hour the dollar amount of one HOUR of their work for the projects that THEY need, no one would be in this mess.
  - CamperBob2 9y ago
    Or you know, don't be a entitled jerk of an user who can't be bothered to support Free (as in Speech, NOT as in beer) Software. (Shrug) I've authored a large amount of software that's free as in both. I sign my releases for my users' protection, and also to avoid looking like a careless dilettante. I expect others who are serious about their craft to do the same. If that makes me an "entitled jerk," well... meh. There's no way to respond to an accusation like that except to own it.
    - JohnTHaller 9y ago
      While its great that you have a spare $100 a year and the money to invest in Apple hardware to digitally sign Mac builds, not every project will have those resources. Projects that don't have the resources will often publish hashes so that users will be able to check to ensure their download is legitimate before using it. Handbrake does this: https://handbrake.fr/checksums.php https://handbrake.fr/checksums.php
      - CamperBob2 9y ago
        Handbrake does this: https://handbrake.fr/checksums.php https://handbrake.fr/checksums.php And how's that been working out for them (and their users)?
      - JohnTHaller 9y ago
        > And how's that been working out for them (and their users)? It likely worked out fine for anyone who checked the SHA256 before installing it. Which, unfortunately, is likely a small minority of users.
      - ReligiousFlames 9y ago
        Checksums != signatures For free, the author could simply GPG sign all releases for all platforms and suggest users verify them. Then, the decision to run untrusted code is the user's decision and bypasses platform monetization. Then, if suffient and continual contributions of money and expertise permit, official codesigning per platform could be added as another layer (defense-in-depth).
  - myrandomcomment 9y ago
    Wow. Waste of bits (your comment). Please take your political agenda some where else. This is the 3rd time this author has been compromised. For $99 it seems a bit negligence on his part. Donations are not excepted so... "The HandBrake and HandBrake Documentation projects are not accepting monetary donations. Please instead consider donating to the VideoLAN non-profit organization and the Blender Foundation."
- tclancy 9y ago
  Explain that to me slowly: if you're enjoying the work of someone from a place where the economy is vastly different and worse than where you live, that person should feel bad about your loss or inconvenience? Please use very small words. I am struggling.
  - CamperBob2 9y ago
    Handbrake is a very popular package. It's probably downloaded about a million times a year. It would be very easy for the author to pay for a code-signing certificate with either donations from users or unobtrusive, inoffensive amounts of advertising. Best practices call for releases of executable code to be signed for the reasons outlined here. Small enough?
    - tclancy 9y ago
      Almost, but I got stuck on the part where you didn't offer to buy the certificate.
      - CamperBob2 9y ago
        What about the part about millions of downloads being enough to pay for it?

CamperBob2 9y ago

If the author of Handbrake is one of them, that can hardly be construed as the users' fault. Run some Google ads or something.

rglullis 9y ago
Or you know, don't be a entitled jerk of an user who can't be bothered to support Free (as in Speech, NOT as in beer) Software. Come on, if every developer that uses any kind of Free Software decided to donate every hour the dollar amount of one HOUR of their work for the projects that THEY need, no one would be in this mess.
- CamperBob2 9y ago
  Or you know, don't be a entitled jerk of an user who can't be bothered to support Free (as in Speech, NOT as in beer) Software. (Shrug) I've authored a large amount of software that's free as in both. I sign my releases for my users' protection, and also to avoid looking like a careless dilettante. I expect others who are serious about their craft to do the same. If that makes me an "entitled jerk," well... meh. There's no way to respond to an accusation like that except to own it.
  - JohnTHaller 9y ago
    While its great that you have a spare $100 a year and the money to invest in Apple hardware to digitally sign Mac builds, not every project will have those resources. Projects that don't have the resources will often publish hashes so that users will be able to check to ensure their download is legitimate before using it. Handbrake does this: https://handbrake.fr/checksums.php https://handbrake.fr/checksums.php
    - CamperBob2 9y ago
      Handbrake does this: https://handbrake.fr/checksums.php https://handbrake.fr/checksums.php And how's that been working out for them (and their users)?
    - JohnTHaller 9y ago
      > And how's that been working out for them (and their users)? It likely worked out fine for anyone who checked the SHA256 before installing it. Which, unfortunately, is likely a small minority of users.
    - ReligiousFlames 9y ago
      Checksums != signatures For free, the author could simply GPG sign all releases for all platforms and suggest users verify them. Then, the decision to run untrusted code is the user's decision and bypasses platform monetization. Then, if suffient and continual contributions of money and expertise permit, official codesigning per platform could be added as another layer (defense-in-depth).
- myrandomcomment 9y ago
  Wow. Waste of bits (your comment). Please take your political agenda some where else. This is the 3rd time this author has been compromised. For $99 it seems a bit negligence on his part. Donations are not excepted so... "The HandBrake and HandBrake Documentation projects are not accepting monetary donations. Please instead consider donating to the VideoLAN non-profit organization and the Blender Foundation."
tclancy 9y ago
Explain that to me slowly: if you're enjoying the work of someone from a place where the economy is vastly different and worse than where you live, that person should feel bad about your loss or inconvenience? Please use very small words. I am struggling.
- CamperBob2 9y ago
  Handbrake is a very popular package. It's probably downloaded about a million times a year. It would be very easy for the author to pay for a code-signing certificate with either donations from users or unobtrusive, inoffensive amounts of advertising. Best practices call for releases of executable code to be signed for the reasons outlined here. Small enough?
  - tclancy 9y ago
    Almost, but I got stuck on the part where you didn't offer to buy the certificate.
    - CamperBob2 9y ago
      What about the part about millions of downloads being enough to pay for it?