3 ms·

I"m curious what the actual negative impact of this would be - ImageMagick is a command-line tool (or runs in-proc somehow) and rarely used directly by end-user

I"m curious what the actual negative impact of this would be - ImageMagick is a command-line tool (or runs in-proc somehow) and rarely used directly by end-users, just like LAME and ffmpeg - and the binaries are far more often shipped as part of another application. My day-job SaaS uses ImageMagick on Windows (long story), but this doesn't affect us - I imagine most other users will be the same. I'm surprised they even make an installer for Windows at-all instead of only shipping portable zips.

jabroni_salad 3y ago
Some PDF-related apps used to bundle ghostscript's installer as a silent install and it would just appear in your programs list. Then those users would see a mysterous entity named ghostscript in their start menu and complain online about it being malware or whatever. The ghostscript people decided to disable their silent installer because of it. The fallout has been that corpos can build it from their source and ship it themselves if they need it so bad, and users are always informed up front about what is coming to their computers. Let that stick in your brain for next time you wonder why Windows still hasn't gotten a competent package manager that can wrangle dependencies. The userbase has been made terminally paranoid by decades of trojans and adware installers.
- DaiPlusPlus 3y ago
  > Let that stick in your brain for next time you wonder why Windows still hasn't gotten a competent package manager that can wrangle dependencies. winget?
  - orra 3y ago
    Winget just runs installers and uninstallers. I don't think it wrangles dependencies. That is, it won't install a dependency as its own package, nor will it uninstall a dependency when the last dependent is uninstalled.
    - vbezhenar 3y ago
      Every sane windows installer will take care of it.
    - TeMPOraL 3y ago
      Honestly, winget at this point is (or is about to be) suffering from the same trust issues GP described. I recently tried to provision a new Windows install with some software, and for many common tools, I found that winget offered suspiciously many similarly named options to choose from. Sometimes all the options look off in some way, like having weird vendor names. For me, this is a regression compared to just downloading installers from the web - at least I find it easier to find the official site of the product (and distinguish it from fake sites with malware), and pull it from there. Or, increasingly often, get an installer from a Github release.
      - WorldMaker 3y ago
        winget supports multiple sources and you can filter on them. One of the default sources is 'msstore' and includes the Microsoft Store and it shows all that junk unscrupulous vendors have added. (Keep in mind it is all reportable if it is pretending to be an open source tool but not from an "owner" developer. `winget show package-id` used to include the Store reporting URL but doesn't currently seem to show it. Maybe it was abused?) The other source is 'winget' which is mostly powered by an open source repo [1] that you can file issues against and even try to make PRs. So far the "winget" source seems relatively well curated. `winget show Package.Id` seems to me reliable at matching up official sites/GitHub releases for that source. At times I'm tempted to `winget source remove msstore` because it is full of so much junk, but I still also appreciate being able to manage store installs with winget. [1] https://github.com/microsoft/winget-pkgs https://github.com/microsoft/winget-pkgs
bitwize 3y ago
Windows Defender assumes files of unknown provenance are malicious and will block or quarantine them -- even (especially!) if they came from a zip file rather than an installer. Anyone who wishes to distribute binaries for Windows needs to have them signed.
justsomehnguy 3y ago
You will be prompted 'do you want to run this executable' if an installer of something would try to run IM installer. Similar to WireShark and WinPcap. If some retards pushed ghostscript people to remove the silent installer then this can lead to anything, up to alien invasion. > I'm surprised they even make an installer for Windows at-all instead of only shipping portable zips. You really appreciate that when you are managing a fleet. Though you can always slap a script or NSIS installer yourself, it's way easier if it's already done.

jabroni_salad 3y ago

Some PDF-related apps used to bundle ghostscript's installer as a silent install and it would just appear in your programs list. Then those users would see a mysterous entity named ghostscript in their start menu and complain online about it being malware or whatever. The ghostscript people decided to disable their silent installer because of it. The fallout has been that corpos can build it from their source and ship it themselves if they need it so bad, and users are always informed up front about what is coming to their computers. Let that stick in your brain for next time you wonder why Windows still hasn't gotten a competent package manager that can wrangle dependencies. The userbase has been made terminally paranoid by decades of trojans and adware installers.

DaiPlusPlus 3y ago
> Let that stick in your brain for next time you wonder why Windows still hasn't gotten a competent package manager that can wrangle dependencies. winget?
- orra 3y ago
  Winget just runs installers and uninstallers. I don't think it wrangles dependencies. That is, it won't install a dependency as its own package, nor will it uninstall a dependency when the last dependent is uninstalled.
  - vbezhenar 3y ago
    Every sane windows installer will take care of it.
  - TeMPOraL 3y ago
    Honestly, winget at this point is (or is about to be) suffering from the same trust issues GP described. I recently tried to provision a new Windows install with some software, and for many common tools, I found that winget offered suspiciously many similarly named options to choose from. Sometimes all the options look off in some way, like having weird vendor names. For me, this is a regression compared to just downloading installers from the web - at least I find it easier to find the official site of the product (and distinguish it from fake sites with malware), and pull it from there. Or, increasingly often, get an installer from a Github release.
    - WorldMaker 3y ago
      winget supports multiple sources and you can filter on them. One of the default sources is 'msstore' and includes the Microsoft Store and it shows all that junk unscrupulous vendors have added. (Keep in mind it is all reportable if it is pretending to be an open source tool but not from an "owner" developer. `winget show package-id` used to include the Store reporting URL but doesn't currently seem to show it. Maybe it was abused?) The other source is 'winget' which is mostly powered by an open source repo [1] that you can file issues against and even try to make PRs. So far the "winget" source seems relatively well curated. `winget show Package.Id` seems to me reliable at matching up official sites/GitHub releases for that source. At times I'm tempted to `winget source remove msstore` because it is full of so much junk, but I still also appreciate being able to manage store installs with winget. [1] https://github.com/microsoft/winget-pkgs https://github.com/microsoft/winget-pkgs

bitwize 3y ago

Windows Defender assumes files of unknown provenance are malicious and will block or quarantine them -- even (especially!) if they came from a zip file rather than an installer. Anyone who wishes to distribute binaries for Windows needs to have them signed.

justsomehnguy 3y ago

You will be prompted 'do you want to run this executable' if an installer of something would try to run IM installer. Similar to WireShark and WinPcap. If some retards pushed ghostscript people to remove the silent installer then this can lead to anything, up to alien invasion. > I'm surprised they even make an installer for Windows at-all instead of only shipping portable zips. You really appreciate that when you are managing a fleet. Though you can always slap a script or NSIS installer yourself, it's way easier if it's already done.