3 ms·
Nuget/.NET ecosystem just handles it so much better. Netvips assumes libvips is available and they provide packages for common platforms. No need to waste elect
by yread 4mo ago
Nuget/.NET ecosystem just handles it so much better. Netvips assumes libvips is available and they provide packages for common platforms. No need to waste electricity rebuilding stuff, or install native build chains, build and test deps. Similar for Skia or Sqlite or whatever.
- tom1337 4mo agobut how can you verify that the prebuilt binaries aren’t compromised?
- voidUpdate 4mo agoOut of interest, do you verify that every single binary file on your machine isn't compromised? All the packages coming from your package manager?
- tom1337 4mo agoI absolutely don't. I even sometimes use "curl | bash" to install new things on my machine because most of the time it's easy and I tend to trust the authors. My point was just that I don't think moving to pre-built binaries solves this issue.
- jcupitt 4mo agosharp downloads over https and checks the sha256 (I think?) of the archive.
- jcupitt 4mo agosharp does this too: https://sharp.pixelplumbing.com/install/#prebuilt-binaries https://sharp.pixelplumbing.com/install/#prebuilt-binaries it can sometimes need to compile the C++ shim that sits between node and libvips, but that's rare.