3 ms·

> The long term solution is to get off the platform. Ug. Running untrusted executables on any platform can be trouble. The problem is that by blaming the platf

> The long term solution is to get off the platform. Ug. Running untrusted executables on any platform can be trouble. The problem is that by blaming the platform, people keep putting the onus on these OS's, distros, etc to build walls around carefully curated gardens. Gotta take the good with the bad. Either you accept that people can run untrusted executables or you give up the flexibility to build/use/distribute untrusted executables yourself. Sadly it seems as devs grow into larger companies and prefer the latter, they forget their indie beginnings enabled by the former. "What's $100?" they say. "Getting a cert is easy" they say. "If you aren't building anything dangerous, why do you have a problem with curation?" they say. The same anti-freedom arguments are always there in the name of safety. If you downloaded untrusted Filezilla and executed it raw on any platform it could be an issue. If users required Filezilla to be distributed in the Windows app store, it could be less of an issue. One could argue the fact that installing Windows software is sometimes still like this is because of the lack of restrictions against it. But as users keep complaining and devs stay silent, all platforms including Windows will continue to reduce liberty in the name of safety and you'll feel better.

code_duck 8y ago
It sounds like you have a lot more experience with windows than other platforms. Many who have mainly used windows haven't experienced what typical software installation is like on systems like Linux. One hardly ever needs to run on trusted executables, for any reason. If you do, they come from one or two trusted sources, not one of hundreds of private websites. That is just not how Linux software is distributed. It doesn't abridge freedom, either - if you want to run I trusted executables, nothing is trying to stop you, either. Then, if you do have an executable to install from, the installation process is more likely to be one command run in a terminal then a GUI 'wizard' that takes 10 minutes, frequent attention and 20 clicks, and tries to convince/trick you to install a bunch of other software.
- kodablah 8y ago
  My experience ranges across platforms which is why I call out this ridiculous bias when I see it, especially when it uses dumb examples like Filezilla to represent the whole. Look at the other options for Filezilla downloads. The default Mac one is the same bundled crap from the same source. The Linux one is from the same source too. Of course I would be unreasonable to criticize the other platforms if the forum post was about those instead. > One hardly ever needs to run on trusted executables, for any reason. If you do, they come from one or two trusted sources, not one of hundreds of private websites That's just not true if you want up to date software. I can list a ton of software to the contrary and lots of installing that includes just extracting tarballs, or installing their deb/rpm you download, or if they use the distro package manager, they just have you add their server and cert. > GUI 'wizard' that takes 10 minutes, frequent attention and 20 clicks Well if you're just gonna give false impressions with hyperbole, a rational discussion can't be had. Regardless, the issues with installation are primarily the choice of the devs, not the OS. These days they more look like the installation of Nodejs, Go, PgAdmin, VSCode, etc (i.e. minimal MSI's or just zip extracts) than complicated adware of yore. That this is not clear and you think 10 minute wizards with 20 clicks is normal makes it seem like you are not familiar with the platforms you talk about.
  - Symbiote 8y ago
    > The Linux one is from the same source too. Not in practise. The Linux version of Filezilla will usually be sourced from a package manager: $ apt show filezilla Package: filezilla Version: 3.28.0-1 … Description: Full-featured graphical FTP/FTPS/SFTP client Even Filezilla's own website says "It is highly recommended to use the package management system of your distribution". A huge portion of the software a typical user requires is available in the standard repository of a Linux distribution. I have one extra Apt repository configured that would be reasonable for a normal user to install: Skype.
    - kodablah 8y ago
      Meh, they don't keep versions up to date. That version in the apt repo is several versions behind (not to mention how far behind they are on 16.04 repos), not something you usually want to do with network software like Filezilla. My comment listed just 4 pieces of software off the top of my head I installed on a fresh desktop recently, and I wouldn't get any of them from default apt install.
      - mirimir 8y ago
        Honorable providers, for example the Tor and MPTCP projects, run their own repositories, with GnuPG-authenticated packages. You get up-to-date builds, with no crap.
        shawnz 8y ago
        But this negates the advantage of having a small number of trusted repos if you need to add third-party repos for every project.
        mirimir 8y ago
        Sure. And it's a tradeoff. The Tor and MPTCP projects came to mind, because I trust them. And there aren't many others that I trust. My problem is that I prefer Debian stable, which is very conservative about package updates. But sometimes I end up using Ubuntu, because its repo includes newer packages. Also, my core systems do not include anything except stable Debian. I only use third-party repos in project-specific VMs. I even use Oracle's MySQL Workbench in an Ubuntu VM. And even Windows 10 VMs, when I need Excel or other Windows-only apps. That is, compartmentalization.
jakelazaroff 8y ago
macOS has a good solution to this, where attempting to open an unsigned binary will fail and warn the user, but can be overridden in the file's context menu.
- kodablah 8y ago
  Windows has the same thing (well, unsigned downloaded binaries that aren't otherwise vetted/popular).
- dogma1138 8y ago
  https://en.m.wikipedia.org/wiki/Microsoft_SmartScreen https://en.m.wikipedia.org/wiki/Microsoft_SmartScreen And this is considerably better than the “this app was downloaded from the internet do you want to open it” message that OSX provides which Windows provides by default also to all files downloaded from the internet.
  - anyfoo 8y ago
    The message you mention is not what was meant.
    - dogma1138 8y ago
      It’s exactly what was meant as you need to do shift+open to install unsigned apps which doesn’t add much if anything.

code_duck 8y ago

It sounds like you have a lot more experience with windows than other platforms. Many who have mainly used windows haven't experienced what typical software installation is like on systems like Linux. One hardly ever needs to run on trusted executables, for any reason. If you do, they come from one or two trusted sources, not one of hundreds of private websites. That is just not how Linux software is distributed. It doesn't abridge freedom, either - if you want to run I trusted executables, nothing is trying to stop you, either. Then, if you do have an executable to install from, the installation process is more likely to be one command run in a terminal then a GUI 'wizard' that takes 10 minutes, frequent attention and 20 clicks, and tries to convince/trick you to install a bunch of other software.

kodablah 8y ago
My experience ranges across platforms which is why I call out this ridiculous bias when I see it, especially when it uses dumb examples like Filezilla to represent the whole. Look at the other options for Filezilla downloads. The default Mac one is the same bundled crap from the same source. The Linux one is from the same source too. Of course I would be unreasonable to criticize the other platforms if the forum post was about those instead. > One hardly ever needs to run on trusted executables, for any reason. If you do, they come from one or two trusted sources, not one of hundreds of private websites That's just not true if you want up to date software. I can list a ton of software to the contrary and lots of installing that includes just extracting tarballs, or installing their deb/rpm you download, or if they use the distro package manager, they just have you add their server and cert. > GUI 'wizard' that takes 10 minutes, frequent attention and 20 clicks Well if you're just gonna give false impressions with hyperbole, a rational discussion can't be had. Regardless, the issues with installation are primarily the choice of the devs, not the OS. These days they more look like the installation of Nodejs, Go, PgAdmin, VSCode, etc (i.e. minimal MSI's or just zip extracts) than complicated adware of yore. That this is not clear and you think 10 minute wizards with 20 clicks is normal makes it seem like you are not familiar with the platforms you talk about.
- Symbiote 8y ago
  > The Linux one is from the same source too. Not in practise. The Linux version of Filezilla will usually be sourced from a package manager: $ apt show filezilla Package: filezilla Version: 3.28.0-1 … Description: Full-featured graphical FTP/FTPS/SFTP client Even Filezilla's own website says "It is highly recommended to use the package management system of your distribution". A huge portion of the software a typical user requires is available in the standard repository of a Linux distribution. I have one extra Apt repository configured that would be reasonable for a normal user to install: Skype.
  - kodablah 8y ago
    Meh, they don't keep versions up to date. That version in the apt repo is several versions behind (not to mention how far behind they are on 16.04 repos), not something you usually want to do with network software like Filezilla. My comment listed just 4 pieces of software off the top of my head I installed on a fresh desktop recently, and I wouldn't get any of them from default apt install.
    - mirimir 8y ago
      Honorable providers, for example the Tor and MPTCP projects, run their own repositories, with GnuPG-authenticated packages. You get up-to-date builds, with no crap.
      - shawnz 8y ago
        But this negates the advantage of having a small number of trusted repos if you need to add third-party repos for every project.
        mirimir 8y ago
        Sure. And it's a tradeoff. The Tor and MPTCP projects came to mind, because I trust them. And there aren't many others that I trust. My problem is that I prefer Debian stable, which is very conservative about package updates. But sometimes I end up using Ubuntu, because its repo includes newer packages. Also, my core systems do not include anything except stable Debian. I only use third-party repos in project-specific VMs. I even use Oracle's MySQL Workbench in an Ubuntu VM. And even Windows 10 VMs, when I need Excel or other Windows-only apps. That is, compartmentalization.

jakelazaroff 8y ago

macOS has a good solution to this, where attempting to open an unsigned binary will fail and warn the user, but can be overridden in the file's context menu.

kodablah 8y ago
Windows has the same thing (well, unsigned downloaded binaries that aren't otherwise vetted/popular).
dogma1138 8y ago
https://en.m.wikipedia.org/wiki/Microsoft_SmartScreen https://en.m.wikipedia.org/wiki/Microsoft_SmartScreen And this is considerably better than the “this app was downloaded from the internet do you want to open it” message that OSX provides which Windows provides by default also to all files downloaded from the internet.
- anyfoo 8y ago
  The message you mention is not what was meant.
  - dogma1138 8y ago
    It’s exactly what was meant as you need to do shift+open to install unsigned apps which doesn’t add much if anything.