Hacker News Reader

Comment by throwaway290 | Hacker News Reader

It's three times the size of the DAW itself, and unlike the DAW it requires using an installer during which it asks for admin password. Wow. Wonder what happened to "just drop this file into that dir" README.txt...

View on HN

Users want an installer. You can see what the installers are doing by looking at the scripts in the repo (this is an open source project). Admin permission is necessary to write to the Global VST folder. You can direct your "Wow" at Steinberg if you want. The spec was recently updated to allow for a User install location which has been considered: https://steinbergmedia.github.io/vst3_dev_portal/pages/Techn...

If you don't want an installer, you can download the pluginsonly bundle on the release page and do it yourself: https://github.com/surge-synthesizer/releases-xt/releases

> You can direct your "Wow" at Steinberg if you want.

Plenty of plugins just ship with a README and tell you where to drop em though! Even paid. So especially if it's OSS I don't think it's bad to require a bit of effort from the user especially if it takes unpaid time maintaining the installer wrapper. Thanks for the bundle link!

Audio plugins folders are a bit of mess. Even I appreciate the installer.

Of course it's more convenient. You just have to hope a hacker did not replace the link on their website to a modified version or not sneaked some code into their installer code through a dependency. Installer is basically root for free so it's very tempting.

Putting a file into "that dir" also requires elevated permissions.

(e.g. C:\Program Files\VSTPlugins )

Of course but the point is I do that myself. Installer just asks for permissions and does who knows what.

Then the binary does who knows what so in any case you are kind of bound to your trust in the vendor.

Plugins themselves never require admin access to run, the installer does.

Unless you are running your plugins in a sandbox or have different profiles for different usages, this doesn't make any difference as what is more important, your personal data is accessible from your main user.

Anyone producing music from qubesOS?

Are you saying it makes no difference whether process runs as root or normal user in whatever OS you're on?

I am saying it depends of the attack scenario.

Privilege escalation is a big issue for servers and mutualized systems. On a personal computer this is the least of your concerns as your personnal data is more valuable than some binaries in your root filesystem. People are ready to get their precious data pwned or ransomwared but are afraid some process would get root access, this is backwards thinking.

In many systems today an app is sandboxed and doesn't get full disk access unless it's granted. But installer gets full access, since it can plug the password into su/sudo and do whatever.

Reply on news.ycombinator.com