4 ms·

That's a collosal red flag.

by barumi 6y ago

benatkin 6y ago
It depends on what you're looking for. It's similar to other third-party component libraries out there. There are open source and closed source ones. With the closed source ones you can take a leap of faith and trust the developer of the project, how it's documented, what it does, and decide whether or not to use it. If you submit to an app store, they can decide whether to approve it. There are closed-source third-party component libraries out there that have a lot less info about the project and the creator than this one, that get distributed to end users. GitHub has quite a large and varied audience. Some expect GitHub to have only open source software that can be vetted by examining the source code. For those it's a red flag. There are plenty of other developers for which it isn't a red flag, though.
- barumi 6y ago
  > It depends on what you're looking for. Security, for starters. There is no way around this. > It's similar to other third-party component libraries out there. There are open source and closed source ones. You're trying to side-step the fact that a random user uploaded binaries that were crafted to do god knows what to the host's computer in a way that circumvents basic auditing and security checks, and did so while hijacking/piggybacking on popular software projects. You can try to spin this any way you want, but you need to be crazy to download and run these binaries as there is zero assurance they are not malware.
  - benatkin 6y ago
    It isn't a random user. The author of the repo has quite an online presence and track record. My top choice, all other things equal, is open source code but I know I don't read all the code and rely on a trust network. A lot of open source code is distributed as binaries these days, in go, rust, docker, and others. Developers have an option to download the source and compile it ourselves but they don't always do it. It's convenient to be able to download a self-contained binary. I'm not trying to spin it, just to point out that I'd have an easier time trusting this than I'd have trusting many open source projects.
  - imtringued 6y ago
    "a random user" is the developer of Sciter, which is the UI engine used by practically every antivirus software on the planet. This is just a demo of his new project that combines Sciter with a JS engine. He only provided demo binaries because he is running a crowdfunding campaign to release the opensource version.
    - Biganon 6y ago
      Honest question: why anti-virus software? What makes sciter especially appropriate for them?
      - lifthrasiir 6y ago
        According to this SO question [1] with the OP's answer, it seems that most AVs share the Material-like design for which Sciter suits. Using Electron in AVs (among others that would only require the layout engine) would be silly. [1] https://stackoverflow.com/questions/40325806/how-this-type-of-gui-is-made https://stackoverflow.com/questions/40325806/how-this-type-o...
imtringued 6y ago
How is that a red flag? The project hasn't been released yet and you still complain that someone went out of their way to make a demo available?

That's a collosal red flag.

by barumi 6y ago

That's a collosal red flag.

It depends on what you're looking for. It's similar to other third-party component libraries out there. There are open source and closed source ones. With the closed source ones you can take a leap of faith and trust the developer of the project, how it's documented, what it does, and decide whether or not to use it. If you submit to an app store, they can decide whether to approve it. There are closed-source third-party component libraries out there that have a lot less info about the project and the creator than this one, that get distributed to end users. GitHub has quite a large and varied audience. Some expect GitHub to have only open source software that can be vetted by examining the source code. For those it's a red flag. There are plenty of other developers for which it isn't a red flag, though.

barumi 6y ago
> It depends on what you're looking for. Security, for starters. There is no way around this. > It's similar to other third-party component libraries out there. There are open source and closed source ones. You're trying to side-step the fact that a random user uploaded binaries that were crafted to do god knows what to the host's computer in a way that circumvents basic auditing and security checks, and did so while hijacking/piggybacking on popular software projects. You can try to spin this any way you want, but you need to be crazy to download and run these binaries as there is zero assurance they are not malware.
- benatkin 6y ago
  It isn't a random user. The author of the repo has quite an online presence and track record. My top choice, all other things equal, is open source code but I know I don't read all the code and rely on a trust network. A lot of open source code is distributed as binaries these days, in go, rust, docker, and others. Developers have an option to download the source and compile it ourselves but they don't always do it. It's convenient to be able to download a self-contained binary. I'm not trying to spin it, just to point out that I'd have an easier time trusting this than I'd have trusting many open source projects.
- imtringued 6y ago
  "a random user" is the developer of Sciter, which is the UI engine used by practically every antivirus software on the planet. This is just a demo of his new project that combines Sciter with a JS engine. He only provided demo binaries because he is running a crowdfunding campaign to release the opensource version.
  - Biganon 6y ago
    Honest question: why anti-virus software? What makes sciter especially appropriate for them?
    - lifthrasiir 6y ago
      According to this SO question [1] with the OP's answer, it seems that most AVs share the Material-like design for which Sciter suits. Using Electron in AVs (among others that would only require the layout engine) would be silly. [1] https://stackoverflow.com/questions/40325806/how-this-type-of-gui-is-made https://stackoverflow.com/questions/40325806/how-this-type-o...

imtringued 6y ago

How is that a red flag? The project hasn't been released yet and you still complain that someone went out of their way to make a demo available?