6 ms·

Shipping .exe and .dll directly in github source repo?

by est 6y ago

quickthrower2 6y ago
And no source code!
- dimeatree 6y ago
  Check out his github profile, it exists in another repo
  - gigel82 6y ago
    No, it doesn't, they're using GitHub to store binary builds of this closed-source project.
    - mwill 6y ago
      This is one of my biggest pet peeves, the worst offender is companies that have a github logo on their page, you click through, and their only repos are binaries, or documentation. It's hard not to see it as intentionally misleading.
      - elmo2you 6y ago
        I fully agree with that. Even more, I'm not so sure that it is in accordance with Github's rules, and might (sometimes) even be in in direct violation of the license with which it is got published. Either way, it certainly feels abusive. While I did read a lot of positive things about this particular project in several of the comments, one thing just rubs me the wrong way (and I can't shake it) .. it is the short time frame (left) until the kickstarter will run out, with the clearly stated intent to not open source if it doesn't make enough money in time. That just feels wrong on too many levels. I'm quite surprised actually, that I didn't see this pointing out by more people.
gigel82 6y ago
It looks like the author was trying to crowd-fund open-sourcing this project: https://www.kickstarter.com/projects/c-smile/open-source-sciter-engine https://www.kickstarter.com/projects/c-smile/open-source-sci... I think we'd be better off trying to slim down Chromium or reviving the idea of using the built-in OS WebView control (which is mostly Chromium nowadays anyway), at least that would be a standard web environment.
- eitland 6y ago
  I've already pledged. Helping in avoiding making Chromium the default is icing on top of the cake. Edit: I also want a massively cut down, blazingly fast rendering engine for a subset of html that is big enough for Wikipedia. Specifically I want it to be paired with a strictly limited version of something like Javascript, only limited and with batteries included. Dynamically updating content on user clicks should be OK, running general calculations should be hard.
  - ComodoHacker 6y ago
    That's what Sciter (with TIScript) is now.
- gitgud 6y ago
  Under the Kickstarter information: > "...Some of these directions better suit Open Source development model for many reasons." So they want $100,000 to give people the source code. Then they're saying it will suit Open Source Development (also requesting free labour from the community).... this is a red flag
  - dmitriid 6y ago
    They want $100,000 to fund work on open sourcing code that people will then use for free. As far as red flags go, educate yourself: open source work is unsustainable without external sources of income: https://staltz.com/software-below-the-poverty-line.html https://staltz.com/software-below-the-poverty-line.html
barumi 6y ago
That's a collosal red flag.
- benatkin 6y ago
  It depends on what you're looking for. It's similar to other third-party component libraries out there. There are open source and closed source ones. With the closed source ones you can take a leap of faith and trust the developer of the project, how it's documented, what it does, and decide whether or not to use it. If you submit to an app store, they can decide whether to approve it. There are closed-source third-party component libraries out there that have a lot less info about the project and the creator than this one, that get distributed to end users. GitHub has quite a large and varied audience. Some expect GitHub to have only open source software that can be vetted by examining the source code. For those it's a red flag. There are plenty of other developers for which it isn't a red flag, though.
  - barumi 6y ago
    > It depends on what you're looking for. Security, for starters. There is no way around this. > It's similar to other third-party component libraries out there. There are open source and closed source ones. You're trying to side-step the fact that a random user uploaded binaries that were crafted to do god knows what to the host's computer in a way that circumvents basic auditing and security checks, and did so while hijacking/piggybacking on popular software projects. You can try to spin this any way you want, but you need to be crazy to download and run these binaries as there is zero assurance they are not malware.
    - benatkin 6y ago
      It isn't a random user. The author of the repo has quite an online presence and track record. My top choice, all other things equal, is open source code but I know I don't read all the code and rely on a trust network. A lot of open source code is distributed as binaries these days, in go, rust, docker, and others. Developers have an option to download the source and compile it ourselves but they don't always do it. It's convenient to be able to download a self-contained binary. I'm not trying to spin it, just to point out that I'd have an easier time trusting this than I'd have trusting many open source projects.

Shipping .exe and .dll directly in github source repo?

by est 6y ago

Shipping .exe and .dll directly in github source repo?

quickthrower2 6y ago

And no source code!

dimeatree 6y ago
Check out his github profile, it exists in another repo
- gigel82 6y ago
  No, it doesn't, they're using GitHub to store binary builds of this closed-source project.
  - mwill 6y ago
    This is one of my biggest pet peeves, the worst offender is companies that have a github logo on their page, you click through, and their only repos are binaries, or documentation. It's hard not to see it as intentionally misleading.
    - elmo2you 6y ago
      I fully agree with that. Even more, I'm not so sure that it is in accordance with Github's rules, and might (sometimes) even be in in direct violation of the license with which it is got published. Either way, it certainly feels abusive. While I did read a lot of positive things about this particular project in several of the comments, one thing just rubs me the wrong way (and I can't shake it) .. it is the short time frame (left) until the kickstarter will run out, with the clearly stated intent to not open source if it doesn't make enough money in time. That just feels wrong on too many levels. I'm quite surprised actually, that I didn't see this pointing out by more people.

gigel82 6y ago

It looks like the author was trying to crowd-fund open-sourcing this project: https://www.kickstarter.com/projects/c-smile/open-source-sciter-engine https://www.kickstarter.com/projects/c-smile/open-source-sci... I think we'd be better off trying to slim down Chromium or reviving the idea of using the built-in OS WebView control (which is mostly Chromium nowadays anyway), at least that would be a standard web environment.

eitland 6y ago
I've already pledged. Helping in avoiding making Chromium the default is icing on top of the cake. Edit: I also want a massively cut down, blazingly fast rendering engine for a subset of html that is big enough for Wikipedia. Specifically I want it to be paired with a strictly limited version of something like Javascript, only limited and with batteries included. Dynamically updating content on user clicks should be OK, running general calculations should be hard.
- ComodoHacker 6y ago
  That's what Sciter (with TIScript) is now.
gitgud 6y ago
Under the Kickstarter information: > "...Some of these directions better suit Open Source development model for many reasons." So they want $100,000 to give people the source code. Then they're saying it will suit Open Source Development (also requesting free labour from the community).... this is a red flag
- dmitriid 6y ago
  They want $100,000 to fund work on open sourcing code that people will then use for free. As far as red flags go, educate yourself: open source work is unsustainable without external sources of income: https://staltz.com/software-below-the-poverty-line.html https://staltz.com/software-below-the-poverty-line.html

barumi 6y ago

That's a collosal red flag.

benatkin 6y ago
It depends on what you're looking for. It's similar to other third-party component libraries out there. There are open source and closed source ones. With the closed source ones you can take a leap of faith and trust the developer of the project, how it's documented, what it does, and decide whether or not to use it. If you submit to an app store, they can decide whether to approve it. There are closed-source third-party component libraries out there that have a lot less info about the project and the creator than this one, that get distributed to end users. GitHub has quite a large and varied audience. Some expect GitHub to have only open source software that can be vetted by examining the source code. For those it's a red flag. There are plenty of other developers for which it isn't a red flag, though.
- barumi 6y ago
  > It depends on what you're looking for. Security, for starters. There is no way around this. > It's similar to other third-party component libraries out there. There are open source and closed source ones. You're trying to side-step the fact that a random user uploaded binaries that were crafted to do god knows what to the host's computer in a way that circumvents basic auditing and security checks, and did so while hijacking/piggybacking on popular software projects. You can try to spin this any way you want, but you need to be crazy to download and run these binaries as there is zero assurance they are not malware.
  - benatkin 6y ago
    It isn't a random user. The author of the repo has quite an online presence and track record. My top choice, all other things equal, is open source code but I know I don't read all the code and rely on a trust network. A lot of open source code is distributed as binaries these days, in go, rust, docker, and others. Developers have an option to download the source and compile it ourselves but they don't always do it. It's convenient to be able to download a self-contained binary. I'm not trying to spin it, just to point out that I'd have an easier time trusting this than I'd have trusting many open source projects.