Hacker News Reader

Comment by DaiPlusPlus | Hacker News Reader

I"m curious what the actual negative impact of this would be - ImageMagick is a command-line tool (or runs in-proc somehow) and rarely used directly by end-users, just like LAME and ffmpeg - and the binaries are far more often shipped as part of another application.

My day-job SaaS uses ImageMagick on Windows (long story), but this doesn't affect us - I imagine most other users will be the same.

I'm surprised they even make an installer for Windows at-all instead of only shipping portable zips.

View on HN

Some PDF-related apps used to bundle ghostscript's installer as a silent install and it would just appear in your programs list. Then those users would see a mysterous entity named ghostscript in their start menu and complain online about it being malware or whatever. The ghostscript people decided to disable their silent installer because of it.

The fallout has been that corpos can build it from their source and ship it themselves if they need it so bad, and users are always informed up front about what is coming to their computers.

Let that stick in your brain for next time you wonder why Windows still hasn't gotten a competent package manager that can wrangle dependencies. The userbase has been made terminally paranoid by decades of trojans and adware installers.

> Let that stick in your brain for next time you wonder why Windows still hasn't gotten a competent package manager that can wrangle dependencies.

winget?

Winget just runs installers and uninstallers. I don't think it wrangles dependencies. That is, it won't install a dependency as its own package, nor will it uninstall a dependency when the last dependent is uninstalled.

Every sane windows installer will take care of it.

Honestly, winget at this point is (or is about to be) suffering from the same trust issues GP described. I recently tried to provision a new Windows install with some software, and for many common tools, I found that winget offered suspiciously many similarly named options to choose from. Sometimes all the options look off in some way, like having weird vendor names.

For me, this is a regression compared to just downloading installers from the web - at least I find it easier to find the official site of the product (and distinguish it from fake sites with malware), and pull it from there. Or, increasingly often, get an installer from a Github release.

winget supports multiple sources and you can filter on them. One of the default sources is 'msstore' and includes the Microsoft Store and it shows all that junk unscrupulous vendors have added. (Keep in mind it is all reportable if it is pretending to be an open source tool but not from an "owner" developer. `winget show package-id` used to include the Store reporting URL but doesn't currently seem to show it. Maybe it was abused?) The other source is 'winget' which is mostly powered by an open source repo [1] that you can file issues against and even try to make PRs.

So far the "winget" source seems relatively well curated. `winget show Package.Id` seems to me reliable at matching up official sites/GitHub releases for that source.

At times I'm tempted to `winget source remove msstore` because it is full of so much junk, but I still also appreciate being able to manage store installs with winget.

[1] https://github.com/microsoft/winget-pkgs

Windows Defender assumes files of unknown provenance are malicious and will block or quarantine them -- even (especially!) if they came from a zip file rather than an installer. Anyone who wishes to distribute binaries for Windows needs to have them signed.

You will be prompted 'do you want to run this executable' if an installer of something would try to run IM installer. Similar to WireShark and WinPcap. If some retards pushed ghostscript people to remove the silent installer then this can lead to anything, up to alien invasion.

> I'm surprised they even make an installer for Windows at-all instead of only shipping portable zips.

You really appreciate that when you are managing a fleet. Though you can always slap a script or NSIS installer yourself, it's way easier if it's already done.

Reply on news.ycombinator.com