I'll be honest. You've put way more thought into this then I did. But in the spirit of hacker news, I'll continue the argument. > There are no implications.

I'll be honest. You've put way more thought into this then I did. But in the spirit of hacker news, I'll continue the argument. > There are no implications. Untrue and absolutist. > Simply downloading a zip from Amazon has zero risk. Agreed. > Even opening an arbitrary zip has essentially zero risk. RCE from opening a zip is obviously a really critical and valuable vulnerability and would not be wasted with a public link. Broadly agreed. History is full of unzip vulns, but I agree that this doesn't seem likely. Much easier to persuade folks to deliberately run their malware by using the latest fad as a hook. I'm not claiming that happened here. > Combine that with the fact that this comes from a voice cloning GitHub repo and the chance of this having some 0-day are infinitesimal. Maybe you know these authors and this repo and trust them. I don't. I'm sure they are lovely, I have no idea, I've done no research, and I've never heard of them before. That being said, if I wanted to distribute a backdoor or cryptominer to a bunch of people with powerful computers, I'd definitely hop on the AI bandwagon. > Finally just making the link non-clickable does not add security. I disagree. Some of the commenters here are rather savvy and will properly evaluate what they are downloading. Some are not. Making a link unclickable will prevent a percentage of people from downloading. If shenanigans are discovered, someone will make a very loud comment warning folks to avoid the download. In that case some of those non-downloaders may have been saved from themselves. Again, this wasn't a well thought out decision, but it was also a rather low impact decision, and I stand by it.