5 ms·
To clarify (1), we should not be exchanging tarballs, period. Regardless of whether it's different from what's in the source repository. It's 2024, not 1994. I
by kijin 3y ago
To clarify (1), we should not be exchanging tarballs, period. Regardless of whether it's different from what's in the source repository.
It's 2024, not 1994. If something masquerading as open-source software is not committed to, and built from, a publicly verifiable version-controlled repository, it might as well not exist.
- professoretc 3y agoSo all of Fabrice Bellard's projects (https://bellard.org/ https://bellard.org/) should not exist?
- kijin 3y agoMost of his well-known projects have public git repositories that you can clone, inspect, and contribute to.
- ycombinatrix 3y agoif these projects have any value, someone will clone them to a public repository.
- AshamedCaptain 3y agoWhile introducing minor changes to the build system scripts, you mean?
- ycombinatrix 3y agoi'll take any publicly visible build system over a hidden one
- AshamedCaptain 3y agoNothing here was ever hidden.
- ycombinatrix 3y agoall of Fabrice Bellard's projects are primarily available as tarballs from their website. definitely more hidden than a public git repo. and allows for xz style backdoors without being able to investigate them after the fact.
- AshamedCaptain 3y agoI don't see what point you're trying to make. For me a tarball is at least as public as a "public git repo" (whatever that means). In fact I would argue a git repository allows for way more opportunities for obfuscation, seeing that it is a much more complex format.