4 ms·

Yeah, Linux especially I've never downloaded and installed something manually from the internet. I get all of my packages directly from: pacman -S foo Or so

Yeah, Linux especially I've never downloaded and installed something manually from the internet. I get all of my packages directly from: pacman -S foo Or sometimes maybe: yaourt -S foo tl;dr Use your operating-system's package manager.

logicallee 9y ago
Who downvoted the above, and why - it seems like a genuine reply for how the parent commenter does things, written from the perspective of a user? -- EDIT: to the reply to this, when I posted my comment, the parent was greyed out. (not now.) whoever did it obviously has some opinion, they should just reply with it so it adds to the discussion. (which I'm just reading, didn't contribute anything else to.)
- gtirloni 9y ago
  How do you know someone downvoted it? It looks the same as others to me (not grayed out).
badosu 9y ago
AUR (Arch User Repository) is a great way to provide user and vendor provided installers IMO: you can check the build script, comment on it, flag outdated ones define and change maintainers while providing a web interface as well.
egypturnash 9y ago
MacOS's package manager is the App Store. Which Handbrake isn't on. It isn't on the Windows store either as far as I can tell. Why, I don't know - maybe nobody involved wants to pay the fees to become an Authorized Developer, maybe there's a Free Software religious argument going on, maybe Apple doesn't want a program whose original function was "ripping DVDs" to be on there because of the many deals they have with the entertainment industry. tl;dr: the program in question ain't in the operating system's package manager.
- libeclipse 9y ago
  Maybe use operating systems that have proper package managers then. cough Arch cough
- derimagia 9y ago
  App store has a lot of issues as is, I actively try to avoid the app store. I'm sure it's more secure, but security isn't everything. The issue doesn't have to do with the app store, it's being careful what you are downloading no matter what it's from.
Macha 9y ago
The AUR (Since you mention yaourt) or PPAs are the linux equivalent of downloading random crap off developer homepages though. They have benefits in terms of updates etc. but they're no more secure (And you may want to look at the next PKGBUILD you install and see how many of them are literally just grabbing stuff off third party servers anyway) See for example: * Kivy: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=python-kivy-git https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=pytho... * Chrome: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=google-chrome https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=googl... * Vivaldi: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vivaldi https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vival... * Plymouth (over HTTP too!): https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=plymouth https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=plymo... * Oracle JDK (also plaintext HTTP!): https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=jdk https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=jdk
- floatboth 9y ago
  That's how pretty much all packages in any distribution are built. Note the included hashes — if the file on the server gets replaced, the building process will complain. (Sure the package maintainer will probably just replace the hash :D But if the file changed but the version number didn't change, or there was no release announcement, that's suspicious…)
  - kingosticks 9y ago
    But arch pulls these files and rebuilds every time, right? Compared to most other distros where only the (more) savvy maintainer does these steps. Don't arch end users just assume there's a new version out and the package hasn't been updated, ignore the error and install anyway? Or are they better trained to take notice of this suspicious stuff?
    - floatboth 9y ago
      > ignore the error and install anyway I don't remember how Arch does it, but in FreeBSD Ports you need to actively replace the hash in the text file, there's no easy ignore option. (FreeBSD also mirrors the files on the project's servers, which is pretty cool)
jackewiehose 9y ago
I'm using linux for some time and I installed tons of software without my package manager (thats unavoidable because not every package archive has every software). In the end its all about trust. If you trust some web domain you can also trust their software. If that software is compromised you're out of luck. No package manager or walled apple garden can help you with that.
- clarry 9y ago
  But there is more to trust than just domains (web servers): signatures. If only people used these.

logicallee 9y ago

Who downvoted the above, and why - it seems like a genuine reply for how the parent commenter does things, written from the perspective of a user? -- EDIT: to the reply to this, when I posted my comment, the parent was greyed out. (not now.) whoever did it obviously has some opinion, they should just reply with it so it adds to the discussion. (which I'm just reading, didn't contribute anything else to.)

gtirloni 9y ago
How do you know someone downvoted it? It looks the same as others to me (not grayed out).

badosu 9y ago

AUR (Arch User Repository) is a great way to provide user and vendor provided installers IMO: you can check the build script, comment on it, flag outdated ones define and change maintainers while providing a web interface as well.

egypturnash 9y ago

MacOS's package manager is the App Store. Which Handbrake isn't on. It isn't on the Windows store either as far as I can tell. Why, I don't know - maybe nobody involved wants to pay the fees to become an Authorized Developer, maybe there's a Free Software religious argument going on, maybe Apple doesn't want a program whose original function was "ripping DVDs" to be on there because of the many deals they have with the entertainment industry. tl;dr: the program in question ain't in the operating system's package manager.

libeclipse 9y ago
Maybe use operating systems that have proper package managers then. cough Arch cough
derimagia 9y ago
App store has a lot of issues as is, I actively try to avoid the app store. I'm sure it's more secure, but security isn't everything. The issue doesn't have to do with the app store, it's being careful what you are downloading no matter what it's from.

Macha 9y ago

The AUR (Since you mention yaourt) or PPAs are the linux equivalent of downloading random crap off developer homepages though. They have benefits in terms of updates etc. but they're no more secure (And you may want to look at the next PKGBUILD you install and see how many of them are literally just grabbing stuff off third party servers anyway) See for example: * Kivy: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=python-kivy-git https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=pytho... * Chrome: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=google-chrome https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=googl... * Vivaldi: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vivaldi https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vival... * Plymouth (over HTTP too!): https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=plymouth https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=plymo... * Oracle JDK (also plaintext HTTP!): https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=jdk https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=jdk

floatboth 9y ago
That's how pretty much all packages in any distribution are built. Note the included hashes — if the file on the server gets replaced, the building process will complain. (Sure the package maintainer will probably just replace the hash :D But if the file changed but the version number didn't change, or there was no release announcement, that's suspicious…)
- kingosticks 9y ago
  But arch pulls these files and rebuilds every time, right? Compared to most other distros where only the (more) savvy maintainer does these steps. Don't arch end users just assume there's a new version out and the package hasn't been updated, ignore the error and install anyway? Or are they better trained to take notice of this suspicious stuff?
  - floatboth 9y ago
    > ignore the error and install anyway I don't remember how Arch does it, but in FreeBSD Ports you need to actively replace the hash in the text file, there's no easy ignore option. (FreeBSD also mirrors the files on the project's servers, which is pretty cool)

jackewiehose 9y ago

I'm using linux for some time and I installed tons of software without my package manager (thats unavoidable because not every package archive has every software). In the end its all about trust. If you trust some web domain you can also trust their software. If that software is compromised you're out of luck. No package manager or walled apple garden can help you with that.

clarry 9y ago
But there is more to trust than just domains (web servers): signatures. If only people used these.