Hacker News Reader

Comment by notorandit | Hacker News Reader

Why? To make it simpler to distribute binaries? What is the use case share for portable binaries across platforms? The platform check is to be run at every single run, not just once, if I am not mistaken. I thought we were aiming at efficiency.

It is an interesting and intriguing technology, but pretty useless if not even dangerous, IMHO.

View on HN

It's insanely cool and not dangerous at all. Why would it be dangerous?

But I'm sure the platform owners, notably Apple and Microsoft, will find ways to prevent the widespread use of such technology. You have to buy certificates, notarize, sign, get reviewed, etc., so they can make extra money off developers and keep total control of their users in the name of some fake security theater. That's why everybody is writing web apps instead.

It'd be dangerous to bring portable binaries among systems on removable media.

Again, platform checks are run at every binary run instead just once at compilation time.

That’s a rather specific case, why not have the apps on a company server that permitted people can fetch? Installers from the web? One app that works across Mac, Linux, PC is quite nice with only one code base to maintain. That’s just one way this is useful and shouldn’t be characterized as dangerous

Seems pretty damn useful to me. You can throw a bunch of programs on a flash drive and use them on any computer you happen to be in front of.

The programs mutate themselves at first use, or at least they did originally, meaning the drive needs to keep copies of the original on it and copy them before running to later work usefully at a second machine.

This is when the dangers come in. Removable media with binaries roaming among different systems. The perfect vector for viruses and Trojans.

It has no downside for the user, but simplifies automated builds and tests dramatically, because you don't need a 'build matrix'.

Ever heard about autoconf/automake?

I have yet to find an autotools project that crosscompiles out of the box there is always some detail that doesn't work. Autotools always provides the ability to do it but it isn't by default.

Yeah, it's outdated crap and doesn't work on Windows with MSVC, better use an actual cross-platform build tool from the current century ;)

Proper build tooling still doesn't change the fact that you need to stamp out one binary per OS and CPU architecture, potentially using different compilers. This is always brittle (I would know: https://github.com/floooh/sokol-tools/actions/runs/107248810...)

Yes, only bad things.

There are billions of dollars in investment basically just to avoid dealing with those

Ease of distribution is what made Electron so dominant (in addition to being familiar to web devs), leading application providers literally bundling an entire web browser just to display a single website.

Here's your use-case: providing a saner alternative to Electron. The Qt solution is more performant than the current solution.

What makes electron easier to distribute? Electron is also made out of binaries which needs to be provided for each platform

While that has to be done, it doesn't have to be the developer.

Electron provide a solution for that https://www.electronforge.io/

So you whip up a web app, throw it into the forge, and bam you got your binaries.

It literally says in the first sentence that deployment on many platforms can be challenging. Checking the platform is trivial, presumably, and a necessary part of what is being done here.

I agree that this might be a dangerous thing to use, but it's not unprecedented. This has a lot in common with using cross-compiling process. If performance is good, it could potentially replace something like AppImage I guess. However, making all your dependencies compile with this thing and then debugging the result may end up being harder than maintaining however many separate builds. It sounds amazing to me that they got Qt to work with this tool. I don't see myself using this but I might take a closer look one day for the hell of it.

how many milliseconds do you think wasting at the start is too much?

ebassi moment

I'm also curious about the actual usecases. This seems very highly niche.

This can also lead to security issues, as it encourages the use of shared folders or USB drives for carrying around executables. You should never reuse executables from other systems - always download one from the first party.

What is it with USB drives that bothers you people so much? It's just storage. Apps could also come from a cloud drive, which would be no more dangerous.

All I hear is "ewww, physical media!"

It's not about USB. It's about executables, and syncing-over-cloud is equally dangerous w/ executables. Perhaps, syncing is worse than USB, because it will write executables right into your home directory, which isn't mounted with NOEXEC flag, where USB would be mounted with it by default (depending on the policy).

Security-wise, copying executables b/w systems amplifies the risk of escalating partial write access on one system to full system access on many other systems. This would be an easy building block for "Advanced Persistent Threat"[1] attacks.

[1]: https://en.wikipedia.org/wiki/Advanced_persistent_threat

Reply on news.ycombinator.com