Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HandBrake 1.0.0 Released

handbrake.fr

Post reply on HN
Print view View original

151–160 of 181 posts

Re: HandBrake 1.0.0 Released

#151

Post by throwaway4891a »

AnthonyMouse wrote: post #98
NelsonMinar wrote: post #60

I'm a little surprised they aren't signing their MacOS releases. It's even documented on the download page, "We are not currently able to sign the HandBrake downloads". I wonder if it's a philosophical choice or a legal one? It seems like a failure of Apple's Gatekeeper though: either because such a popular app is not able to be signed, or because it's not signed and yet so many people run it anyway.

> I'm a little surprised they aren't signing their MacOS releases. Do any small developers actually do this? It seems entirely useless from a security prospective. You go through an expensive process so that at the end it can "verify" that the binary was signed by an individual the user has never met who may not even live in the same country and for all anyone knows is perfectly willing to sign ransomware, or who has…

Apple's codesign ensures end-to-end chain-of-custody integrity with nonrepudiation, tied to a specific, named signer and likely also a credit-card.

GPG signing and releasing fingerprints of all released artifacts on an https://-served release notice would accomplish nearly the same thing, but requires more steps and causes a confusing `“HandBrake” can’t be opened because it is from an unidentified developer.` dialog.

It is a best-practice to both GPG sign all release artifacts and use vendor-specific code-signing / app stores, otherwise conversion will suffer with each additional hoop multiplied by the N of the entire user-base resulting in much more time-wasting.

End-to-end integrity also prevents entire classes of attacks such as hacked CDNs, hacked networks and so on.

Re: HandBrake 1.0.0 Released

#152

Post by throwaway4891a »

NelsonMinar wrote: post #60

I'm a little surprised they aren't signing their MacOS releases. It's even documented on the download page, "We are not currently able to sign the HandBrake downloads". I wonder if it's a philosophical choice or a legal one? It seems like a failure of Apple's Gatekeeper though: either because such a popular app is not able to be signed, or because it's not signed and yet so many people run it anyway.

I'm not using 1.0.0+ until it's codesigned and/or dmg gpg verifiable with a known-good signature.

Do not install untrusted, unverifiable apps is security 101.

Re: HandBrake 1.0.0 Released

#153

Post by realityking »

AnthonyMouse wrote: post #144
seanalltogether wrote: post #141

Earlier quoted context omitted.

There is no expense to have a developer account with Apple to sign releases. You have to pay to distribute on iOS or Mac App store. At this point so much of it is automated by xcode that there are no real extra steps to do simple developer signed release.

The expense isn't so much money you pay to Apple, it's the typically multiple hours and hundreds of dollars necessary to get an EV certificate from a CA.

Code signing on macOS does not rely on CA certificates but you have to be a member of the paid Apple Developer program (99$/year)

Re: HandBrake 1.0.0 Released

#155

Post by nemof »

germinalphrase wrote: post #86
aw3c2 wrote: post #58

Earlier quoted context omitted.

Rest assured that there are archivists ripping their discs losslessly somewhere in the dark corners of the internet. Hidden because the copyright mafia will otherwise ruin their lives.

I once knew of a group like this. eventually, thy disappeared - but it was the most wonderful way to access otherwise unavailable arthouse and experimental cinema. I miss it.

sc? i used to knew a few groups like this that concentrated on obscure arthouse films, but i've long since forgotten their names about from sc. there was another one that had something to do with a crow i think. hmm.

Re: HandBrake 1.0.0 Released

#156

Post by jsgo »

I haven't upgraded in quite a while due to there being a shift at .15 I believe it was where the AAC codec used had licensing issues (whether with the library makers or in what the library makers were implementing). Only affected Windows and Linux I believe. Is this still an issue? Is there a way to rebuild it including the lost component(s) as I believe they mentioned at the time the replacement was inferior?

Re: HandBrake 1.0.0 Released

#157

Post by eliasbagley »

Ah brings back memories of my college days when I would go to the library at night when the computer labs were empty, check out a dozen dvds on 4 hour loan, and use a separate computer to rip each one at the same time.

Re: HandBrake 1.0.0 Released

#158

Post by nradov »

throwaway4891a wrote: post #152
NelsonMinar wrote: post #60

I'm a little surprised they aren't signing their MacOS releases. It's even documented on the download page, "We are not currently able to sign the HandBrake downloads". I wonder if it's a philosophical choice or a legal one? It seems like a failure of Apple's Gatekeeper though: either because such a popular app is not able to be signed, or because it's not signed and yet so many people run it anyway.

I'm not using 1.0.0+ until it's codesigned and/or dmg gpg verifiable with a known-good signature. Do not install untrusted, unverifiable apps is security 101.

Just download the source code, audit it, and built it yourself.

Re: HandBrake 1.0.0 Released

#160

Post by rockdoe »

feld wrote: post #101
rockdoe wrote: post #62

Earlier quoted context omitted.

H.265 only compresses twice as much as H.264 in marketing materials, or when not comparing to x264. It is trivial to change the defaults to give half the bitrate but you will not get the same quality.

I just saw bluray rips of the same show on Usenet. x264 = 2.5GB, x265 = 600MB. I'm not certain the scene releasers with reputations to maintain are going to release terrible quality rips.

The same people who insisted on 192 kbps CBR non-joint stereo for years? Hahaha...
Post reply on HN