12 ms·

The screenshot features the excellent Surge synth. Check it out if you don't know it, it's an excellent sounding synth with a gorgeous oscillators section.

throwaway290 3y ago
It's three times the size of the DAW itself, and unlike the DAW it requires using an installer during which it asks for admin password. Wow. Wonder what happened to "just drop this file into that dir" README.txt...
- radiowave 3y ago
  Putting a file into "that dir" also requires elevated permissions. (e.g. C:\Program Files\VSTPlugins )
  - throwaway290 3y ago
    Of course but the point is I do that myself. Installer just asks for permissions and does who knows what.
    - prmoustache 3y ago
      Then the binary does who knows what so in any case you are kind of bound to your trust in the vendor.
      - throwaway290 3y ago
        Plugins themselves never require admin access to run, the installer does.
        prmoustache 3y ago
        Unless you are running your plugins in a sandbox or have different profiles for different usages, this doesn't make any difference as what is more important, your personal data is accessible from your main user. Anyone producing music from qubesOS?
        throwaway290 3y ago
        Are you saying it makes no difference whether process runs as root or normal user in whatever OS you're on?
        prmoustache 3y ago
        I am saying it depends of the attack scenario. Privilege escalation is a big issue for servers and mutualized systems. On a personal computer this is the least of your concerns as your personnal data is more valuable than some binaries in your root filesystem. People are ready to get their precious data pwned or ransomwared but are afraid some process would get root access, this is backwards thinking.
        throwaway290 3y ago
        In many systems today an app is sandboxed and doesn't get full disk access unless it's granted. But installer gets full access, since it can plug the password into su/sudo and do whatever.
- rovingeye 3y ago
  Users want an installer. You can see what the installers are doing by looking at the scripts in the repo (this is an open source project). Admin permission is necessary to write to the Global VST folder. You can direct your "Wow" at Steinberg if you want. The spec was recently updated to allow for a User install location which has been considered: https://steinbergmedia.github.io/vst3_dev_portal/pages/Technical+Documentation/Locations+Format/Plugin+Locations.html https://steinbergmedia.github.io/vst3_dev_portal/pages/Techn... If you don't want an installer, you can download the pluginsonly bundle on the release page and do it yourself: https://github.com/surge-synthesizer/releases-xt/releases https://github.com/surge-synthesizer/releases-xt/releases
  - throwaway290 3y ago
    > You can direct your "Wow" at Steinberg if you want. Plenty of plugins just ship with a README and tell you where to drop em though! Even paid. So especially if it's OSS I don't think it's bad to require a bit of effort from the user especially if it takes unpaid time maintaining the installer wrapper. Thanks for the bundle link!
    - JodieBenitez 3y ago
      Audio plugins folders are a bit of mess. Even I appreciate the installer.
      - throwaway290 3y ago
        Of course it's more convenient. You just have to hope a hacker did not replace the link on their website to a modified version or not sneaked some code into their installer code through a dependency. Installer is basically root for free so it's very tempting.
smoldesu 3y ago
Serge is great, but Vital whips the llama's ass: https://vital.audio/ https://vital.audio/ There was a time when Sylenth and Serum-quality synthesizers didn't exist for free. Back then, shit like Serge and Helm were really the best you could rely on. Maybe a few free U-HE plugins or your DAW defaults. Today's producers are downright spoiled with so many excellent free options!
- nomoreusernames 3y ago
  [dead]

throwaway290 3y ago

It's three times the size of the DAW itself, and unlike the DAW it requires using an installer during which it asks for admin password. Wow. Wonder what happened to "just drop this file into that dir" README.txt...

radiowave 3y ago
Putting a file into "that dir" also requires elevated permissions. (e.g. C:\Program Files\VSTPlugins )
- throwaway290 3y ago
  Of course but the point is I do that myself. Installer just asks for permissions and does who knows what.
  - prmoustache 3y ago
    Then the binary does who knows what so in any case you are kind of bound to your trust in the vendor.
    - throwaway290 3y ago
      Plugins themselves never require admin access to run, the installer does.
      - prmoustache 3y ago
        Unless you are running your plugins in a sandbox or have different profiles for different usages, this doesn't make any difference as what is more important, your personal data is accessible from your main user. Anyone producing music from qubesOS?
        throwaway290 3y ago
        Are you saying it makes no difference whether process runs as root or normal user in whatever OS you're on?
        prmoustache 3y ago
        I am saying it depends of the attack scenario. Privilege escalation is a big issue for servers and mutualized systems. On a personal computer this is the least of your concerns as your personnal data is more valuable than some binaries in your root filesystem. People are ready to get their precious data pwned or ransomwared but are afraid some process would get root access, this is backwards thinking.
        throwaway290 3y ago
        In many systems today an app is sandboxed and doesn't get full disk access unless it's granted. But installer gets full access, since it can plug the password into su/sudo and do whatever.
rovingeye 3y ago
Users want an installer. You can see what the installers are doing by looking at the scripts in the repo (this is an open source project). Admin permission is necessary to write to the Global VST folder. You can direct your "Wow" at Steinberg if you want. The spec was recently updated to allow for a User install location which has been considered: https://steinbergmedia.github.io/vst3_dev_portal/pages/Technical+Documentation/Locations+Format/Plugin+Locations.html https://steinbergmedia.github.io/vst3_dev_portal/pages/Techn... If you don't want an installer, you can download the pluginsonly bundle on the release page and do it yourself: https://github.com/surge-synthesizer/releases-xt/releases https://github.com/surge-synthesizer/releases-xt/releases
- throwaway290 3y ago
  > You can direct your "Wow" at Steinberg if you want. Plenty of plugins just ship with a README and tell you where to drop em though! Even paid. So especially if it's OSS I don't think it's bad to require a bit of effort from the user especially if it takes unpaid time maintaining the installer wrapper. Thanks for the bundle link!
  - JodieBenitez 3y ago
    Audio plugins folders are a bit of mess. Even I appreciate the installer.
    - throwaway290 3y ago
      Of course it's more convenient. You just have to hope a hacker did not replace the link on their website to a modified version or not sneaked some code into their installer code through a dependency. Installer is basically root for free so it's very tempting.

smoldesu 3y ago

Serge is great, but Vital whips the llama's ass: https://vital.audio/ https://vital.audio/ There was a time when Sylenth and Serum-quality synthesizers didn't exist for free. Back then, shit like Serge and Helm were really the best you could rely on. Maybe a few free U-HE plugins or your DAW defaults. Today's producers are downright spoiled with so many excellent free options!

nomoreusernames 3y ago
[dead]