Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Python interpreter? this simple RAT installs its own copy

isc.sans.edu

Post reply on HN
Print view View original

21–30 of 62 posts

Re: No Python interpreter? this simple RAT installs its own copy

#21

Post by Kaze404 »

css wrote: post #2

CD Projekt's GoG client has a feature where users can write Python extensions [0] for third party account integrations. To enable this, they ship an entire Python interpreter alongside the app binary [1]. I guess this kind of makes sense, it is way easier than having users manage their own `venv`s and other Python environment stuff. Packaging Python apps for distribution outside of a Python development context is qui…

Wow, I had no idea Gog allowed that. Can you give examples of these extensions being put to good use?

Re: No Python interpreter? this simple RAT installs its own copy

#22

Post by mrybczyn »

krageon wrote: post #12
css wrote: post #2

CD Projekt's GoG client has a feature where users can write Python extensions [0] for third party account integrations. To enable this, they ship an entire Python interpreter alongside the app binary [1]. I guess this kind of makes sense, it is way easier than having users manage their own `venv`s and other Python environment stuff. Packaging Python apps for distribution outside of a Python development context is qui…

> quite pesky I've never had a bigger packaging nightmare than for Python and at this point I've worked with a substantial spread of available languages. It's simply embarrassing, especially because I used to like recommending it to people.

One of the main reasons I xnay any deployment of any python code to any production environments ever. It's sad and embarassing.

Re: No Python interpreter? this simple RAT installs its own copy

#23

Post by sudasana »

wzdd wrote: post #13
MereInterest wrote: post #9

Earlier quoted context omitted.

I've done this before with pyinstaller, and it's pretty straightforward. This wasn't even for a customer-facing application, instead an internal utility that I had initially made to save myself time. The first time I tried to distribute it without bundling the interpreter and libraries, it took a full hour to get it mostly set up for 4 people. Sure, every problem from multiple conflicting python environments, to pip…

I've had both Sophos and Windows Defender pick up innocuous Pyinstaller-based packages as malware, presumably because packaging malware with Pyinstaller is such a common technique. It's quite frustrating if you intend to release the software. Example issue: https://github.com/pyinstaller/pyinstaller/issues/3802

I've had this issue with recent versions of Pyinstaller and had to roll it back to version 3.4 to avoid it.

Re: No Python interpreter? this simple RAT installs its own copy

#24

Post by m463 »

css wrote: post #2

CD Projekt's GoG client has a feature where users can write Python extensions [0] for third party account integrations. To enable this, they ship an entire Python interpreter alongside the app binary [1]. I guess this kind of makes sense, it is way easier than having users manage their own `venv`s and other Python environment stuff. Packaging Python apps for distribution outside of a Python development context is qui…

Also, when they ship a dosbox game, the installation includes not only dosbox, but a zip file of the dosbox source code.

...and strangely - I don't know if this is only the mac version - they randomly include the manual for a PC game called Harvester

  /Extras/dosbox/dosbox_svn.zip
  ...
  /Extras/Manual.pdf

Re: No Python interpreter? this simple RAT installs its own copy

#25

Post by otachack »

m463 wrote: post #24
css wrote: post #2

CD Projekt's GoG client has a feature where users can write Python extensions [0] for third party account integrations. To enable this, they ship an entire Python interpreter alongside the app binary [1]. I guess this kind of makes sense, it is way easier than having users manage their own `venv`s and other Python environment stuff. Packaging Python apps for distribution outside of a Python development context is qui…

Also, when they ship a dosbox game, the installation includes not only dosbox, but a zip file of the dosbox source code. ...and strangely - I don't know if this is only the mac version - they randomly include the manual for a PC game called Harvester /Extras/dosbox/dosbox_svn.zip ... /Extras/Manual.pdf

Wow that's interesting! It might be a DosBox artifact and GoG didn't sanitize it. Wonder what the back story is: maybe a DosBox maintainer left it in when packaging?

Re: No Python interpreter? this simple RAT installs its own copy

#26

Post by formerly_proven »

otachack wrote: post #25
m463 wrote: post #24

Earlier quoted context omitted.

Also, when they ship a dosbox game, the installation includes not only dosbox, but a zip file of the dosbox source code. ...and strangely - I don't know if this is only the mac version - they randomly include the manual for a PC game called Harvester /Extras/dosbox/dosbox_svn.zip ... /Extras/Manual.pdf

Wow that's interesting! It might be a DosBox artifact and GoG didn't sanitize it. Wonder what the back story is: maybe a DosBox maintainer left it in when packaging?

DosBox is GPL. Shipping the source code isn't required, but an easy way to immediately comply with the license.

Re: No Python interpreter? this simple RAT installs its own copy

#28

Post by lostmsu »

formerly_proven wrote: post #26
otachack wrote: post #25

Earlier quoted context omitted.

Wow that's interesting! It might be a DosBox artifact and GoG didn't sanitize it. Wonder what the back story is: maybe a DosBox maintainer left it in when packaging?

DosBox is GPL. Shipping the source code isn't required, but an easy way to immediately comply with the license.

I always assumed if you ship something, that contains a GPL part, the whole product needs to be GPL too. Is it wrong, and shipping binaries is OK?

Re: No Python interpreter? this simple RAT installs its own copy

#29

Post by PufPufPuf »

icegreentea2 wrote: post #3
css wrote: post #2

CD Projekt's GoG client has a feature where users can write Python extensions [0] for third party account integrations. To enable this, they ship an entire Python interpreter alongside the app binary [1]. I guess this kind of makes sense, it is way easier than having users manage their own `venv`s and other Python environment stuff. Packaging Python apps for distribution outside of a Python development context is qui…

Shipping your own runtimes as part of heavy application isn't that unusual or limited to Python, especially in the Windows world. For example, JetBrains ships its own Java runtime for all of its IDEs. In fact, the Python world would be simplified if "ship your own runtime and env" as part of your final application was the norm. The Python runtime and stdlib by itself is like 20-30MB packaged up or something. For cert…

Isn't that what PyInstaller already does? It bundles your Python app with a runtime. I've seen a few apps distributed like this, even GUI ones.

Re: No Python interpreter? this simple RAT installs its own copy

#30

Post by formerly_proven »

lostmsu wrote: post #28
formerly_proven wrote: post #26

Earlier quoted context omitted.

DosBox is GPL. Shipping the source code isn't required, but an easy way to immediately comply with the license.

I always assumed if you ship something, that contains a GPL part, the whole product needs to be GPL too. Is it wrong, and shipping binaries is OK?

The source of whatever falls under the GPL must be made available (included with the product, download link, "write us a mail and we send you a CD", doesn't matter). Which parts of a product fall under the GPL depends on how exactly it "contains a GPL part".

E.g. When you use a patched version of Linux in your router, then you'd need to make those patches / the patched code available, but you would not need to make the code of your web GUI available.

If you are using libviralgpl.dll in your ProprietarySecrets.dll though, your entire application becomes a subject of the GPL.

Post reply on HN