Live data from Hacker News

No Python interpreter? this simple RAT installs its own copy

isc.sans.edu

41–50 of 62 posts

Re: No Python interpreter? this simple RAT installs its own copy

#42
post #21
post #2

CD Projekt's GoG client has a feature where users can write Python extensions [0] for third party account integrations. To enable this, they ship an entire Python interpreter alongside the app binary [1]. I guess this kind of makes sense, it is way easier than having users manage their own `venv`s and other Python environment stuff. Packaging Python apps for distribution outside of a Python development context is qui…

Wow, I had no idea Gog allowed that. Can you give examples of these extensions being put to good use?

I think the integrations with other platforms are done this way, so I have my games from steam, epic etc and even the titles from my xbox pc pass all in one list in GOG. Dont know about other uses for extensions.

Re: No Python interpreter? this simple RAT installs its own copy

#43
post #19

Earlier quoted context omitted.

Shipping your own runtimes as part of heavy application isn't that unusual or limited to Python, especially in the Windows world. For example, JetBrains ships its own Java runtime for all of its IDEs. In fact, the Python world would be simplified if "ship your own runtime and env" as part of your final application was the norm. The Python runtime and stdlib by itself is like 20-30MB packaged up or something. For cert…

> For example, JetBrains ships its own Java runtime for all of its IDEs. That's actually the recommended way for Java applications nowadays. There is no official current JRE for end-users to download anymore - the newest version you can download from Oracle is 8 update 281. JDK is currently at version 16.

Is that just because openjdk is now the canonical (non-enterprise) jdk? Does openjdk not provide an end-user jre anymore?

Re: No Python interpreter? this simple RAT installs its own copy

#44
post #43
post #19

Earlier quoted context omitted.

> For example, JetBrains ships its own Java runtime for all of its IDEs. That's actually the recommended way for Java applications nowadays. There is no official current JRE for end-users to download anymore - the newest version you can download from Oracle is 8 update 281. JDK is currently at version 16.

Is that just because openjdk is now the canonical (non-enterprise) jdk? Does openjdk not provide an end-user jre anymore?

I don't know the exact thought process that led to this decision but I know that people were incredibly annoyed by the "you need to update Java!" notifications and that applications were rolling their own JRE for quite some time to get around outdated JREs on customer's machines.

Re: No Python interpreter? this simple RAT installs its own copy

#45

Earlier quoted context omitted.

The C Language thanks you for your propaganda.

The C language may be complex to setup an environment. But once you have the build system complete, there are mature tools to create and distribute your artifacts. That is not the case with Python.

Python is downstream of C. Anyway you can package a C application, you can package a Python application (with some massaging).

But still, python has no mature tools for distribution? From wheels to pyinstaller to Kivy, you're just wrong.

Re: No Python interpreter? this simple RAT installs its own copy

#46
post #12

Earlier quoted context omitted.

> quite pesky I've never had a bigger packaging nightmare than for Python and at this point I've worked with a substantial spread of available languages. It's simply embarrassing, especially because I used to like recommending it to people.

Agreed. Python is one of the worst languages in the sense of packaging and distributing code. It is incredible how bad they manage to make the whole process. And it is not for lack of effort, they have attempted several things, but the end result is complete confusion. Every year they come with a new way to solve the packaging problem, but in the end the result is just more complexity.

It won't ever be fixed until Python C API remains in it's current form. The problem aren't pure python extension, but you can't do anything sane once part of your application is not Python.

Re: No Python interpreter? this simple RAT installs its own copy

#47
post #13

Earlier quoted context omitted.

I've done this before with pyinstaller, and it's pretty straightforward. This wasn't even for a customer-facing application, instead an internal utility that I had initially made to save myself time. The first time I tried to distribute it without bundling the interpreter and libraries, it took a full hour to get it mostly set up for 4 people. Sure, every problem from multiple conflicting python environments, to pip…

I've had both Sophos and Windows Defender pick up innocuous Pyinstaller-based packages as malware, presumably because packaging malware with Pyinstaller is such a common technique. It's quite frustrating if you intend to release the software. Example issue: https://github.com/pyinstaller/pyinstaller/issues/3802

Signing created binary with valid certificate usually prevents most of antivir problems, as they act way more lenient in regards to those binaries.

Re: No Python interpreter? this simple RAT installs its own copy

#48

Loving how it also downloads the license.txt file. Very important to respect license agreements when compromising someone's machine

I'm having a hard time deciding which DND alignment would fit that. Probably chaotic evil.

Re: No Python interpreter? this simple RAT installs its own copy

#49
post #2

CD Projekt's GoG client has a feature where users can write Python extensions [0] for third party account integrations. To enable this, they ship an entire Python interpreter alongside the app binary [1]. I guess this kind of makes sense, it is way easier than having users manage their own `venv`s and other Python environment stuff. Packaging Python apps for distribution outside of a Python development context is qui…

that seems quite common in the gaming world. i've seen games packaged with tons of *.pyd files (the python dll equivalent for windows). Probably a large portion of the game logic was implemented in python

Re: No Python interpreter? this simple RAT installs its own copy

#50

Loving how it also downloads the license.txt file. Very important to respect license agreements when compromising someone's machine

I'm having a hard time deciding which DND alignment would fit that. Probably chaotic evil.

Sounds more of a lawful evil to me!
Post reply on HN