5 ms·

I'm assuming this is free-as-in-beer software? Because the default distribution mechanism for free-as-in-speech software is Github, these days. Can't you add i

I'm assuming this is free-as-in-beer software? Because the default distribution mechanism for free-as-in-speech software is Github, these days. Can't you add it to the Windows/Mac/Ubuntu App Store, though? There seems to be lots of free apps on there...

zozbot234 7y ago
> Because the default distribution mechanism for free-as-in-speech software is Github, these days. I surmise that this mostly impacts non-free platforms, where compiling software from source used to be quite non-trivial so it was common to just download binaries. These days you can probably get LLVM to work everywhere, though.
- simion314 7y ago
  Each user compiling a binary is a lot of waste, have you compiled a large project like Chrome or Unreal Engine ? If you are even able to compile it successfully it takes hours on a recent i5. A few years back at my work we were digitally sign our binaries, so I don't think non free platforms are affected at all since it is not expensive to buy a certificate , only hobby/personal projects will be affected. Also a signed binary does not mean there are no viruses or other bad things inside, so I am wondering if we want to identify the source of the binary can we find a technical solution so you can have your website and binary with the same key then you know that binary X is from X.com people, for some reason a few years back this certificates for signing were not cheap.
  - zozbot234 7y ago
    > Each user compiling a binary is a lot of waste It's not "waste" if it's needed to establish trust. > A few years back at my work we were digitally sign our binaries, Just publishing hashes for the (reproducible) unsigned binaries over a secure channel (such as HTTPS as verified by Let's Encrypt) will give you the exact same security. Digital signatures embedded in executables add no security whatsoever, and make reproducibility harder. Just don't do it.
    - simion314 7y ago
      I think it is technically possible to sign a binary and have reproducebility for the people who care, you might need a different binary/package then the current ones but it is technically possible. We had to sign our applications to prevent scary warnings to appear and then we would have to train our users to ignore that.
    - celticmusic 7y ago
      The worst part is that a malicious signed binary could just download the malicious parts afterwards. Signing isn't really an answer for google.
thristian 7y ago
Some developers like to establish a relationship directly with their users, not pay (in dollars, or advertising) a middle-man like GitHub, GitLab, or an App Store.
- nvrspyx 7y ago
  You could simply host the binary on GitHub and GitLab and have the link on your website point directly to it. The user would never know, so you'd get the best of both worlds. You develop a direct relationship with your users without paying anything forward to GitHub or GitLab. With that said, hosting the binary on those platforms won't necessarily help as Google can flag individual repos according to some other comments here.
  - near 7y ago
    Every indication I've read is that simply linking to the binary download, even if it's offsite, will be enough to flag the page hosting the link. So I would have to link to an alternate site hosting the link, and risk that page being blocked instead, and then I'm right back where I started. I would, if at all possible, prefer to find a solution to this problem so that I can directly host my software.
    - gdm85 7y ago
      If you prefer to directly host it then you will have to wait (and hope that no one files a complaint about your domain). At some point your domain will have a sufficient score and it will not show the warnings to users. How long that will take is, however, outside of my knowledge and it would be nice to have some official reference about it; as it stands I agree with you that it feels like begging to a benevolent dictator.
      - GordonS 7y ago
        The point is that these warning still appear for executable downloads from Github (at least they did a few years ago when I independently thought of this as a workaround) - my guess is that Microsoft and Google are using some kind of unique'ish binary fingerprint, such as Imphash or SSDEEP (in conjunction with other signals, such as domain age, digital signature etc)

zozbot234 7y ago

> Because the default distribution mechanism for free-as-in-speech software is Github, these days. I surmise that this mostly impacts non-free platforms, where compiling software from source used to be quite non-trivial so it was common to just download binaries. These days you can probably get LLVM to work everywhere, though.

simion314 7y ago
Each user compiling a binary is a lot of waste, have you compiled a large project like Chrome or Unreal Engine ? If you are even able to compile it successfully it takes hours on a recent i5. A few years back at my work we were digitally sign our binaries, so I don't think non free platforms are affected at all since it is not expensive to buy a certificate , only hobby/personal projects will be affected. Also a signed binary does not mean there are no viruses or other bad things inside, so I am wondering if we want to identify the source of the binary can we find a technical solution so you can have your website and binary with the same key then you know that binary X is from X.com people, for some reason a few years back this certificates for signing were not cheap.
- zozbot234 7y ago
  > Each user compiling a binary is a lot of waste It's not "waste" if it's needed to establish trust. > A few years back at my work we were digitally sign our binaries, Just publishing hashes for the (reproducible) unsigned binaries over a secure channel (such as HTTPS as verified by Let's Encrypt) will give you the exact same security. Digital signatures embedded in executables add no security whatsoever, and make reproducibility harder. Just don't do it.
  - simion314 7y ago
    I think it is technically possible to sign a binary and have reproducebility for the people who care, you might need a different binary/package then the current ones but it is technically possible. We had to sign our applications to prevent scary warnings to appear and then we would have to train our users to ignore that.
  - celticmusic 7y ago
    The worst part is that a malicious signed binary could just download the malicious parts afterwards. Signing isn't really an answer for google.

thristian 7y ago

Some developers like to establish a relationship directly with their users, not pay (in dollars, or advertising) a middle-man like GitHub, GitLab, or an App Store.

nvrspyx 7y ago
You could simply host the binary on GitHub and GitLab and have the link on your website point directly to it. The user would never know, so you'd get the best of both worlds. You develop a direct relationship with your users without paying anything forward to GitHub or GitLab. With that said, hosting the binary on those platforms won't necessarily help as Google can flag individual repos according to some other comments here.
- near 7y ago
  Every indication I've read is that simply linking to the binary download, even if it's offsite, will be enough to flag the page hosting the link. So I would have to link to an alternate site hosting the link, and risk that page being blocked instead, and then I'm right back where I started. I would, if at all possible, prefer to find a solution to this problem so that I can directly host my software.
  - gdm85 7y ago
    If you prefer to directly host it then you will have to wait (and hope that no one files a complaint about your domain). At some point your domain will have a sufficient score and it will not show the warnings to users. How long that will take is, however, outside of my knowledge and it would be nice to have some official reference about it; as it stands I agree with you that it feels like begging to a benevolent dictator.
    - GordonS 7y ago
      The point is that these warning still appear for executable downloads from Github (at least they did a few years ago when I independently thought of this as a workaround) - my guess is that Microsoft and Google are using some kind of unique'ish binary fingerprint, such as Imphash or SSDEEP (in conjunction with other signals, such as domain age, digital signature etc)