5 ms·
Chocolatey and WinGet don’t. Looks like Chocolatey gets the binary from download.mozilla.org [1], while WinGet gets it from download-installer.cdn.mozilla.net
by Tijdreiziger 5y ago
Chocolatey and WinGet don’t.
Looks like Chocolatey gets the binary from download.mozilla.org [1], while WinGet gets it from download-installer.cdn.mozilla.net [2] (which looks to be the HTTPS repository mentioned in the article, thus being exempt from tracking?)
[1] https://community.chocolatey.org/packages/Firefox#files https://community.chocolatey.org/packages/Firefox#files
[2] https://github.com/microsoft/winget-pkgs/blob/master/manifests/m/Mozilla/Firefox/98.0/Mozilla.Firefox.installer.yaml https://github.com/microsoft/winget-pkgs/blob/master/manifes...
- eikenberry 5y agoThis is the difference between a distribution and a simple package manager. Linux distributions have a more holistic approach to this and enforce it with checksums, signatures, reproducible builds, etc. A package manager really only cares about managing the packages installation, dependencies, etc. Not the integrity of the packages themselves.
- easton 5y agoHey, I did that commit to winget-pkgs! It doesn’t look to me like the tracking stuff is on the HTTPS repo links, so they’re probably telling the truth about that. They also ship a version in the Microsoft Store, that should be safe too (I don’t think Microsoft shares user identities for free apps with the developers, maybe I’m wrong?)