Hacker News Reader

Comment by noasaservice | Hacker News Reader

Explain to me how SSL tells me so I know which is the right site:

     https://www.vlcdownload.com
     https://www.vlcdownloads.com
     https://www.videolan.com
     https://www.vlc.com
     https://www.downloadvlc.com
     https://www.videolan.org
     https://www.videolan.co.uk
     https://sourceforge.net/projects/vlc/

In linux/Mac, I can "sudo apt install vlc", "sudo yum install vlc", or "sudo brew install vlc". I know I'm getting a valid and good software delivery. It just works. No malware. No sketchy websites. No malware packages.

On Windows, well, you feelin lucky?

View on HN

That's true, but it cuts both ways.

apt-get install wine

Did you just get Wine from upstream? The answer is no and this has wasted significant amounts of time of Wine developers in the past. I used to be one and spent way too many free evenings and weekends debugging subtle crashes reported by users, that turned out to be packaging bugs introduced by men-in-the-middle.

Lots of other Wine devs had the same experience, so at that time we had a policy that if someone reported a bug the first instruction was to uninstall their distro package and to install the binary packages produced by the Wine project itself. Sometimes users were upset by this advice, but it resolved a significant number of "bugs" that were being added by the distributors.

> On Windows, well, you feelin lucky?

Doesn't chocolatey fit the bill?

https://chocolatey.org/

The whole point of the earlier comments is that it is preferable to use a package manager instead of using a browser to download binaries.

On Windows I can just

   choco install vlc

It is preferable to read comments before replying.

> The whole point of the earlier comments is that it is preferable to use a package manager instead of using a browser to download binaries.

But there are package managers for Windows, aren't there?

Microsoft even has its own app store, that you need to use to install applications such as Windows Terminal.

People often install software on Linux and macOS by downloading installers using a browser. In fact, that's how non-bleeding edge versions of Xcode are installed.

As a practical approach on Windows, for well-known software, I go to Wikipedia, look up the project there and then get the link, obviously that's not guaranteed to be correct, but for well-known projects bad links usually get corrected relatively fast, so it's probably correct

For lesser known projects I just cross my fingers, but typically lesser known projects are less likely to have malware posing as them

Now we have `winget install VideoLAN.VLC` :)

Which is sadly not as intuitive as 'choco install vlc', WinGet really needs to support aliases to become widely used.

Chocolatey does have it's quirks though, there is both a '7zip' and a '7zip.install' package, it's not intuitive what the difference is.

Go to GitHub directly... forget direct links.

Reply on news.ycombinator.com