38 ms·

Telerik gets Fiddler unlisted from Chocolatey

34 points by Arnavion 9y ago

slipstream- 9y ago
"Please keep comments respectful as they own the IP and do not have a public download url." so, they want to waste their money sending spam to all the fake emails everyone enters in their website when they reinstall windows i think they could have thought that through a little better
- dsp1234 9y ago
  do not have a public download url The URL in question[0] provides a 200 response and an executable without requiring authorization/authentication. That's a particularly weird definition of "not public" [0] - https://github.com/chocolatey/chocolatey-coreteampackages/commit/ce6cb44e24f69d511f9bba3f02460548bde807a2 https://github.com/chocolatey/chocolatey-coreteampackages/co... https://www.telerik.com/docs/default-source/fiddler/fiddlersetup.exe https://www.telerik.com/docs/default-source/fiddler/fiddlers...
  - slipstream- 9y ago
    I was quoting from the pinned comment on the page, by the way. And, that is indeed a particularly weird definition of "not public", but from my experience, par for the course when there's only a squeeze page in the way of a download.
    - dsp1234 9y ago
      I was definitely commenting the issue (and likely Telerik's) definition of "not public". The two stated reasons (again, likely just citing Telerik's request), are "they own the ip" and "it's not public" are just bogus. Linking to a publicly accessible resource doesn't have anything to do with IP (using someone's trademark to accurately describe the thing or direct people to it is not a crime, at least in the US), and "it's not public" is just false, as shown. All in all, seems like a cave on Chocolatey's part. Particularly since they have a whole section of their FAQ dedicated to vendor distribution rights[0], which goes through pains to show that most of the time, there is no distribution at all (since it's just automation scripts). This is about as silly as Telerik saying that I can't write: "curl https://www.telerik.com/docs/default-source/fiddler/fiddlersetup.exe" https://www.telerik.com/docs/default-source/fiddler/fiddlers... [0] - https://chocolatey.org/docs/package-triage-process#are-you-a-software-vendor https://chocolatey.org/docs/package-triage-process#are-you-a...
virgil_disgr4ce 9y ago
Was this headline generated by a silicon valley startup name generator or something?
- draw_down 9y ago
  God, I know. The first time I read it I marveled that that could be a real sentence.
- jey 9y ago
  Apparently "Chocolatey" translates roughly as "package manager for Windows", which also explains why the headline made no sense to me.
  - pwinnski 9y ago
    I recognized none of the three names in the title, and following the link didn't help much either. I came back once I saw there were more comments, and now it seems to make a little more sense. Chocolatey is like homebrew for Windows, and Telerik is a company that makes Fiddler, which may be something like Charles for MacOS. Took a bit to figure all that out, though. The title reads like dadaist poetry.
  - emmelaich 9y ago
    Chocolatey is riffing on (or an addition too?) Nuget, the package manager for .Net. Chocolatey Nougat (Nuget) geddit?
sheetjs 9y ago
The related github issue https://github.com/chocolatey/chocolatey-coreteampackages/issues/923 https://github.com/chocolatey/chocolatey-coreteampackages/is... has more context: > Telerik reached out and is asking that the Fiddler package be removed as it is giving direct access to a download location they no longer show on the site. Since they have an information gateway to receive information prior to download, they have asked that we remove the package so that folks obtain the downloads directly from them.
- anaisbetts 9y ago
  Yep, basically they don't want to allow people to download the app without signing up for their spam
  - CanSpice 9y ago
    Turns out you don't need to enter a legit email address. Just use joe@example.com and you're through.
_jezell_ 9y ago
Wireshark is still listed, it's a lot more powerful and open source: https://chocolatey.org/packages/wireshark https://chocolatey.org/packages/wireshark
- voltagex_ 9y ago
  Fiddler works at a different level, and has an easy way to intercept / inspect SSL requests. FWIW, I've also had bluescreens on Windows from a certain combination of NPCAP and an Intel Ethernet driver.
- dsp1234 9y ago
  Does wireshark allow for editing http requests and resending them?
  - ZenoArrow 9y ago
    Not as far as I know. You can use tcpreplay for this, but it's not equivalent to Fiddler: http://tcpreplay.appneta.com/wiki/overview.html http://tcpreplay.appneta.com/wiki/overview.html Whilst it doesn't do everything that Fiddler does, and isn't open-source, I'd say Postman is worth a look for playing around with HTTP requests. The user interface is a lot more user friendly (in my opinion): https://www.getpostman.com/ https://www.getpostman.com/
    - dsp1234 9y ago
      Postman doesn't quite fill the niche, because it can't see all http/https traffic (ex: from other non-browser applications). Also, postman can't see anything that happens to the request after it's submitted (ex: by an anti-virus network filter). Which is not to say that Postman is not good at what it does do.
- deleted 9y ago
  [deleted]
- polkovnikov-ph 9y ago
  Fiddler can install Root CA certificate and use it to sign fake certificates for websites to MitM on HTTPS. If someone knows how to do that in Wireshark, please, tell me.
nlawalker 9y ago
Honest question - why are people so enthusiastic about Chocolatey? Most packages, including the Fiddler package, just run a small Powershell script that downloads an installer from a known location (in this case https://www.telerik.com/docs/default-source/fiddler/fiddlersetup.exe https://www.telerik.com/docs/default-source/fiddler/fiddlers...), verifies the checksum and runs it silently. As far as I know, it's all just wrappers on top of stuff that's always existed in Windows Installer. Is it simply the convenience of the chocolatey.org catalog and the ability to avoid visiting a bunch of websites looking for installers? I thought ninite.com had that cornered for most uses.
- krisdol 9y ago
  This is similar to how a lot of the homebrew cask packages work on OS X. Ninite appears to be more end-user/consumer focused while chocolatey aims for a wider swath of developer packages as well. Personally, I use neither because neither is open source. Instead, I use scoop: http://scoop.sh/ http://scoop.sh/
  - nlawalker 9y ago
    Whoa, thanks. >> Looking for familiar Unix tools? Tired of Powershell’s Verb-Noun verbosity? Sold.
  - lstamour 9y ago
    “Neither”? Yes, Ninite is closed, e.g. https://ninite.com/help/notfeatures/more.html https://ninite.com/help/notfeatures/more.html But alternatives aren’t: Chocolatey - Apache license - https://github.com/chocolatey/choco https://github.com/chocolatey/choco Homebrew (for Mac) - BSD license - https://github.com/Homebrew/brew https://github.com/Homebrew/brew Scoop (as previously mentioned) - Public Domain - https://github.com/lukesampson/scoop https://github.com/lukesampson/scoop Comparing Scoop to Chocolatey: https://github.com/lukesampson/scoop/wiki/Chocolatey-Comparison https://github.com/lukesampson/scoop/wiki/Chocolatey-Compari...
- colemannugent 9y ago
  People are excited to be rescued from the hell of searching the Internet for a program you want. One of the things that regularly blows the minds of people new to the Linux world is the ability to install anything you can remember the name of. While Chocolatey isn't quite there yet (it may never given the difficulty of working around Windows), but it is way better than installing 50 programs manually. Ninite is great for a small selection of apps, but it is not a package manager by any means. For quick setup, yeah it works, but you wouldn't rebuild the installer to install one program, you may as well download the program in the first place.
synicalx 9y ago
The last 10 years have been great for creating headlines that just sound REALLY funny to anyone outside our industry. I just showed this to my partner and she thought this might have been related to the Teletubbies. Actually sometimes, reading news headlines like this sometimes makes me feel like I'm watching an advertisement for a Plumbus from Rick and Morty.
- m_fayer 9y ago
  I automatically read that headline as intended, didn't even smirk. I don't want to forget the absurdity of our world and its little dramas, so thanks for the reminder!
borland 9y ago
Good on them. Software vendors should be able to excercise some control over how their software is distributed. Also, I find any system where someone else tries to "add value" by wrapping or aggregating a bunch of pre-existing stuff without asking for permission from the pre-existing owners to be distasteful and somewhat rude. What's the bet that Chocolately obtained prior permission from Telerik, Mozilla, Google or any other of the software vendors to redistribute their packages? It seems unlikely
- dsp1234 9y ago
  What is your take on me posting the following on my blog: "wget https://www.telerik.com/docs/default-source/fiddler/fiddlersetup.exe https://www.telerik.com/docs/default-source/fiddler/fiddlers... && fiddlersetup.exe" redistribute their packages Chocolately wasn't redistributing the Fiddler packages[0]. [0] - https://github.com/chocolatey/chocolatey-coreteampackages/blob/7da961320cae606213e75815ad53b24dd59968c3/unlisted/fiddler4/tools/chocolateyInstall.ps1 https://github.com/chocolatey/chocolatey-coreteampackages/bl...
  - lstamour 9y ago
    Or in PowerShell (if I’ve the syntax right...typing this on an iPhone) ((https://www.telerik.com/docs/default-source/fiddler/fiddlersetup.exe).Content >fiddlersetup.exe) -and (fiddlersetup.exe)
- akerl_ 9y ago
  Do you feel the same way about Linux distros? For example, should Debian be asking permission from each package before they create a package for it?
  - quietbritishjim 9y ago
    That's a bad example: Debian only packages GPL (or compatible) code, and by releasing something as GPL you are giving certain rights to anyone that receives it, including the right to package it. Put another way, Debian already does get permission before packaging anything (they just don't need to ask).

34 points by Arnavion 9y ago

"Please keep comments respectful as they own the IP and do not have a public download url." so, they want to waste their money sending spam to all the fake emails everyone enters in their website when they reinstall windows i think they could have thought that through a little better

dsp1234 9y ago
do not have a public download url The URL in question[0] provides a 200 response and an executable without requiring authorization/authentication. That's a particularly weird definition of "not public" [0] - https://github.com/chocolatey/chocolatey-coreteampackages/commit/ce6cb44e24f69d511f9bba3f02460548bde807a2 https://github.com/chocolatey/chocolatey-coreteampackages/co... https://www.telerik.com/docs/default-source/fiddler/fiddlersetup.exe https://www.telerik.com/docs/default-source/fiddler/fiddlers...
- slipstream- 9y ago
  I was quoting from the pinned comment on the page, by the way. And, that is indeed a particularly weird definition of "not public", but from my experience, par for the course when there's only a squeeze page in the way of a download.
  - dsp1234 9y ago
    I was definitely commenting the issue (and likely Telerik's) definition of "not public". The two stated reasons (again, likely just citing Telerik's request), are "they own the ip" and "it's not public" are just bogus. Linking to a publicly accessible resource doesn't have anything to do with IP (using someone's trademark to accurately describe the thing or direct people to it is not a crime, at least in the US), and "it's not public" is just false, as shown. All in all, seems like a cave on Chocolatey's part. Particularly since they have a whole section of their FAQ dedicated to vendor distribution rights[0], which goes through pains to show that most of the time, there is no distribution at all (since it's just automation scripts). This is about as silly as Telerik saying that I can't write: "curl https://www.telerik.com/docs/default-source/fiddler/fiddlersetup.exe" https://www.telerik.com/docs/default-source/fiddler/fiddlers... [0] - https://chocolatey.org/docs/package-triage-process#are-you-a-software-vendor https://chocolatey.org/docs/package-triage-process#are-you-a...

virgil_disgr4ce 9y ago

Was this headline generated by a silicon valley startup name generator or something?

draw_down 9y ago
God, I know. The first time I read it I marveled that that could be a real sentence.
jey 9y ago
Apparently "Chocolatey" translates roughly as "package manager for Windows", which also explains why the headline made no sense to me.
- pwinnski 9y ago
  I recognized none of the three names in the title, and following the link didn't help much either. I came back once I saw there were more comments, and now it seems to make a little more sense. Chocolatey is like homebrew for Windows, and Telerik is a company that makes Fiddler, which may be something like Charles for MacOS. Took a bit to figure all that out, though. The title reads like dadaist poetry.
- emmelaich 9y ago
  Chocolatey is riffing on (or an addition too?) Nuget, the package manager for .Net. Chocolatey Nougat (Nuget) geddit?

sheetjs 9y ago

The related github issue https://github.com/chocolatey/chocolatey-coreteampackages/issues/923 https://github.com/chocolatey/chocolatey-coreteampackages/is... has more context: > Telerik reached out and is asking that the Fiddler package be removed as it is giving direct access to a download location they no longer show on the site. Since they have an information gateway to receive information prior to download, they have asked that we remove the package so that folks obtain the downloads directly from them.

anaisbetts 9y ago
Yep, basically they don't want to allow people to download the app without signing up for their spam
- CanSpice 9y ago
  Turns out you don't need to enter a legit email address. Just use joe@example.com and you're through.

_jezell_ 9y ago

Wireshark is still listed, it's a lot more powerful and open source: https://chocolatey.org/packages/wireshark https://chocolatey.org/packages/wireshark

voltagex_ 9y ago
Fiddler works at a different level, and has an easy way to intercept / inspect SSL requests. FWIW, I've also had bluescreens on Windows from a certain combination of NPCAP and an Intel Ethernet driver.
dsp1234 9y ago
Does wireshark allow for editing http requests and resending them?
- ZenoArrow 9y ago
  Not as far as I know. You can use tcpreplay for this, but it's not equivalent to Fiddler: http://tcpreplay.appneta.com/wiki/overview.html http://tcpreplay.appneta.com/wiki/overview.html Whilst it doesn't do everything that Fiddler does, and isn't open-source, I'd say Postman is worth a look for playing around with HTTP requests. The user interface is a lot more user friendly (in my opinion): https://www.getpostman.com/ https://www.getpostman.com/
  - dsp1234 9y ago
    Postman doesn't quite fill the niche, because it can't see all http/https traffic (ex: from other non-browser applications). Also, postman can't see anything that happens to the request after it's submitted (ex: by an anti-virus network filter). Which is not to say that Postman is not good at what it does do.
deleted 9y ago
[deleted]
polkovnikov-ph 9y ago
Fiddler can install Root CA certificate and use it to sign fake certificates for websites to MitM on HTTPS. If someone knows how to do that in Wireshark, please, tell me.

nlawalker 9y ago

Honest question - why are people so enthusiastic about Chocolatey? Most packages, including the Fiddler package, just run a small Powershell script that downloads an installer from a known location (in this case https://www.telerik.com/docs/default-source/fiddler/fiddlersetup.exe https://www.telerik.com/docs/default-source/fiddler/fiddlers...), verifies the checksum and runs it silently. As far as I know, it's all just wrappers on top of stuff that's always existed in Windows Installer. Is it simply the convenience of the chocolatey.org catalog and the ability to avoid visiting a bunch of websites looking for installers? I thought ninite.com had that cornered for most uses.

krisdol 9y ago
This is similar to how a lot of the homebrew cask packages work on OS X. Ninite appears to be more end-user/consumer focused while chocolatey aims for a wider swath of developer packages as well. Personally, I use neither because neither is open source. Instead, I use scoop: http://scoop.sh/ http://scoop.sh/
- nlawalker 9y ago
  Whoa, thanks. >> Looking for familiar Unix tools? Tired of Powershell’s Verb-Noun verbosity? Sold.
- lstamour 9y ago
  “Neither”? Yes, Ninite is closed, e.g. https://ninite.com/help/notfeatures/more.html https://ninite.com/help/notfeatures/more.html But alternatives aren’t: Chocolatey - Apache license - https://github.com/chocolatey/choco https://github.com/chocolatey/choco Homebrew (for Mac) - BSD license - https://github.com/Homebrew/brew https://github.com/Homebrew/brew Scoop (as previously mentioned) - Public Domain - https://github.com/lukesampson/scoop https://github.com/lukesampson/scoop Comparing Scoop to Chocolatey: https://github.com/lukesampson/scoop/wiki/Chocolatey-Comparison https://github.com/lukesampson/scoop/wiki/Chocolatey-Compari...
colemannugent 9y ago
People are excited to be rescued from the hell of searching the Internet for a program you want. One of the things that regularly blows the minds of people new to the Linux world is the ability to install anything you can remember the name of. While Chocolatey isn't quite there yet (it may never given the difficulty of working around Windows), but it is way better than installing 50 programs manually. Ninite is great for a small selection of apps, but it is not a package manager by any means. For quick setup, yeah it works, but you wouldn't rebuild the installer to install one program, you may as well download the program in the first place.

synicalx 9y ago

The last 10 years have been great for creating headlines that just sound REALLY funny to anyone outside our industry. I just showed this to my partner and she thought this might have been related to the Teletubbies. Actually sometimes, reading news headlines like this sometimes makes me feel like I'm watching an advertisement for a Plumbus from Rick and Morty.

m_fayer 9y ago
I automatically read that headline as intended, didn't even smirk. I don't want to forget the absurdity of our world and its little dramas, so thanks for the reminder!

borland 9y ago

Good on them. Software vendors should be able to excercise some control over how their software is distributed. Also, I find any system where someone else tries to "add value" by wrapping or aggregating a bunch of pre-existing stuff without asking for permission from the pre-existing owners to be distasteful and somewhat rude. What's the bet that Chocolately obtained prior permission from Telerik, Mozilla, Google or any other of the software vendors to redistribute their packages? It seems unlikely

dsp1234 9y ago
What is your take on me posting the following on my blog: "wget https://www.telerik.com/docs/default-source/fiddler/fiddlersetup.exe https://www.telerik.com/docs/default-source/fiddler/fiddlers... && fiddlersetup.exe" redistribute their packages Chocolately wasn't redistributing the Fiddler packages[0]. [0] - https://github.com/chocolatey/chocolatey-coreteampackages/blob/7da961320cae606213e75815ad53b24dd59968c3/unlisted/fiddler4/tools/chocolateyInstall.ps1 https://github.com/chocolatey/chocolatey-coreteampackages/bl...
- lstamour 9y ago
  Or in PowerShell (if I’ve the syntax right...typing this on an iPhone) ((https://www.telerik.com/docs/default-source/fiddler/fiddlersetup.exe).Content >fiddlersetup.exe) -and (fiddlersetup.exe)
akerl_ 9y ago
Do you feel the same way about Linux distros? For example, should Debian be asking permission from each package before they create a package for it?
- quietbritishjim 9y ago
  That's a bad example: Debian only packages GPL (or compatible) code, and by releasing something as GPL you are giving certain rights to anyone that receives it, including the right to package it. Put another way, Debian already does get permission before packaging anything (they just don't need to ask).