Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GIMP Windows Installers move from Sourceforge to ftp.gimp.org

gimp.org

Post reply on HN
Print view View original

71–79 of 79 posts

Re: GIMP Windows Installers move from Sourceforge to ftp.gimp.org

#71

Post by pseut »

illumen wrote: post #58
jlgreco wrote: post #20

Earlier quoted context omitted.

> And to be honest, just seeing a file hosted on SourceForge casts doubts on the quality of the app. I couldn't agree more. Whenever a session of searching for a solution ultimately lands me on a sourceforge page, I feel a pit form in my stomach. When it happens it typically means one of two things, often both: I took a terribly wrong turn somewhere, and/or I am in for a world of hurt. Contrast this with finding myse…

github signals fly by night to many.

Github to a user page, definitely. If it's an organization page I usually feel differently.

Re: GIMP Windows Installers move from Sourceforge to ftp.gimp.org

#72

Post by webreac »

fredsted wrote: post #54
JohnTHaller wrote: post #39

Earlier quoted context omitted.

Most companies block torrents. And software that does torrent downloads often gets flagged as badware. We considered building torrent into the PortableApps.com Platform and getting users to help share bandwidth with other users, but those stumbling blocks are pretty big ones.

>Most companies block torrents. Most companies also block random software like PortableApps.com.

My company (in fact client company) is using bluecoat filter. This is insane crap that block randomly many sites. Hopefully, the company does not block ssh. Bluecoat filter is so much annoying that I have installed a proxy on my home computer. When a site is blocked, I have to fully close Chrome, to launch ssh with a tunnel (two clicks) and to relaunch Chrome using this proxy (one click). I wonder when companies will understand that excessive or bad filtering have opposite consequences. PortableApps.com is awesome (notably xampp). Congrats

Re: GIMP Windows Installers move from Sourceforge to ftp.gimp.org

#73

Post by idupree »

simonhn wrote: post #41
idupree wrote: post #18

Earlier quoted context omitted.

It's hard to download from Sourceforge using HTTPS. (Or even to use HTTPS to get the SHA hash of a download.) Can you tell me how to do it, so I can download from Sourceforge without risk of a man-in-the-middle modifying the download to, say, contain malicious code?

Navigating to the directory from the 'Files' tab and clicking the 'i' icon to the right of each filename available for download displays the 'View details' panel with the SHA1 hash of that file. Is that not enough?

No, because you can't access that hash from https://sourceforge.net/ ( https://sourceforge.net/ is just a redirect to http).

It's slightly more of a nuisance for the attacker to modify the hash as well as the file, but if they can modify the .zip you get, then they'll surely have no trouble doing "s/the original zip's hash/their malicious zip's hash/" on all your unauthenticated web traffic too. It's a simpler modification than Upside-Down-Ternet.

In this case, they do need to create a compromised version of the zip before you view the hash, but that can be arranged with good probability by tracking the web pages you visit, pre-computing compromises of popular downloads, and/or slowing down your page load speed to give them enough time to compute and serve you compromised hashes. It wouldn't be too hard for an accomplished Web villain to have a good shot at compromising your computer if you are using public WiFi or they have ISP or NSA level access, provided you download software insecurely. ( My unfortunately ranty blog post on the matter: http://idupree.dreamwidth.org/3233.html )

HTTPS isn't perfect, but it (and/or other cryptographic signing) is the minimum we should accept for downloads of code that can quietly pwn your user account when you run 'make'.

Re: GIMP Windows Installers move from Sourceforge to ftp.gimp.org

#75

Post by fredsted »

JohnTHaller wrote: post #64
fredsted wrote: post #54

Earlier quoted context omitted.

>Most companies block torrents. Most companies also block random software like PortableApps.com.

You'd be surprised how very few do. We keep things clean, well-behaved, and virus-free for a reason.

I know you do - I use your apps.

But I think writing off torrents because companies filter them isn't a reason to do so.

As long as they can download random executables and run them, they'll be able to download torrents, either via .torrent files, magnet links, via a proxy or whatever method they figure out.

Re: GIMP Windows Installers move from Sourceforge to ftp.gimp.org

#76

Post by JohnTHaller »

fredsted wrote: post #75
JohnTHaller wrote: post #64

Earlier quoted context omitted.

You'd be surprised how very few do. We keep things clean, well-behaved, and virus-free for a reason.

I know you do - I use your apps. But I think writing off torrents because companies filter them isn't a reason to do so. As long as they can download random executables and run them , they'll be able to download torrents, either via .torrent files, magnet links, via a proxy or whatever method they figure out.

Torrents themselves are blocked by most corporate firewalls (and many university ones). Adding torrent abilities to the PortableApps.com Platform, even if we custom wrote it to work with our app store, would encourage places to block our whole platform.

Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn.

Re: GIMP Windows Installers move from Sourceforge to ftp.gimp.org

#77

Post by JohnTHaller »

bad_user wrote: post #70
JohnTHaller wrote: post #66

Earlier quoted context omitted.

I can't seem to find any details on it on their site (it's absent from Features and Documentation) and nothing relevant came up in a quick Google search.

It's there. When viewing your project's details, you've got a tab called "Downloads". You can then upload stuff like binaries, and I quote from that interface: "Add any file that you would like to make available to your users, such as app binaries"

Ah. I don't have an account. So, to me, there's nothing there at all. And if it's not documented (not even a mention in features or the documentation) other than just existing in the admin interface, I don't know that I'd trust it to be there next week.

Re: GIMP Windows Installers move from Sourceforge to ftp.gimp.org

#78

Post by fredsted »

JohnTHaller wrote: post #76
fredsted wrote: post #75

Earlier quoted context omitted.

I know you do - I use your apps. But I think writing off torrents because companies filter them isn't a reason to do so. As long as they can download random executables and run them , they'll be able to download torrents, either via .torrent files, magnet links, via a proxy or whatever method they figure out.

Torrents themselves are blocked by most corporate firewalls (and many university ones). Adding torrent abilities to the PortableApps.com Platform, even if we custom wrote it to work with our app store, would encourage places to block our whole platform. Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn.

>Adding torrent abilities to the PortableApps.com Platform, even if we custom wrote it to work with our app store, would encourage places to block our whole platform.

>Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn.

I think that's a little far-fetched, nearly all open source projects utilize torrents for distribution with noone blocking them. Torrents are just the default way of providing high-speed software mirrors these days.

Re: GIMP Windows Installers move from Sourceforge to ftp.gimp.org

#79

Post by JohnTHaller »

fredsted wrote: post #78
JohnTHaller wrote: post #76

Earlier quoted context omitted.

Torrents themselves are blocked by most corporate firewalls (and many university ones). Adding torrent abilities to the PortableApps.com Platform, even if we custom wrote it to work with our app store, would encourage places to block our whole platform. Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn.

>Adding torrent abilities to the PortableApps.com Platform, even if we custom wrote it to work with our app store, would encourage places to block our whole platform. >Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn. I think that's a little far-fetched, nearly all open source projects utilize torrents for distribution with…

Lots of open source projects make torrents of their files available for download from their website. That's a different animal from building a torrent client into your app. The PortableApps.com Platform is how lots of our users get their apps now, right from the app store or via the automatic app updater, and that all takes place via HTTP. In order to properly use torrents, we'd need to build a client right into the app store so users can use it but still one-click update/install their apps. But, having a torrent client built into the platform would encourage companies to block the platform itself. And, it would leave our users unable to update their apps inside organizations that block torrenting at the network level.
Post reply on HN