Hacker News Reader

To clarify (1), we should not be exchanging tarballs, period. Regardless of whether it's different from what's in the source repository.

It's 2024, not 1994. If something masquerading as open-source software is not committed to, and built from, a publicly verifiable version-controlled repository, it might as well not exist.

View on HN

So all of Fabrice Bellard's projects (https://bellard.org/) should not exist?

Most of his well-known projects have public git repositories that you can clone, inspect, and contribute to.

if these projects have any value, someone will clone them to a public repository.

While introducing minor changes to the build system scripts, you mean?

i'll take any publicly visible build system over a hidden one

Nothing here was ever hidden.

all of Fabrice Bellard's projects are primarily available as tarballs from their website.

definitely more hidden than a public git repo. and allows for xz style backdoors without being able to investigate them after the fact.

I don't see what point you're trying to make. For me a tarball is at least as public as a "public git repo" (whatever that means). In fact I would argue a git repository allows for way more opportunities for obfuscation, seeing that it is a much more complex format.

Reply on news.ycombinator.com