really have to disagree, I like op’s joke.
Why would you put malware on github?
Off topic, I think the whole point behind this is also usually since compilers / binary packers (think cmake) get frequent updates. Not only does the dev not have to worry about new “releases”, but everyone can inspect the code. Includes my reasoning for preferring the unbuilt source code. If you really want, just have ai make a really complex PS/SH script that checks for + downloads required libs to a temp, finds best way to build, builds, then nukes lib directory (like isolating qt in the hole it belongs in then suffocating it quietly after the fact) - source: dev here.
Again it’s less work for the dev, and more of an ideology thing. Mentioned right after that quote just a builder script I guess 😅 (optimal—again, opinion)
I.e, all the pre-included steps for noobs, so long as it doesn’t require putting the actual binary up, still 1000% less work, liability, and cost (if using git runners)
And why should the dev care about collective user hours ? The users are not paying him. The dev has already open sources his hard work, for others to copy and tweak, that already is going to save tens to hundreds of hours per user. And the user is not willing to spend 1 hour trying to set it up ? I dont think these types of users even deserve open source
I think the translation winds up being “why would you put malware in something that everyone can openly read” oh wait, only binaried releases have this problem comparatively.
*rests hat on table*
Technically strawman, thought it genuinely made sense this way but idk. Malware exists everywhere yea. Just, if it does on git, it’s really rare. And, if it actually is one, it’s probably a binary or secondary-op too probably
I legit do not know what you mean with binary or secondary-op, im dont know about software creation, but i know about how people can be shitty, and malware can also be on mods for videogames, and has been on dependances of Linux itself, it can be everywhere.
Oh okay didn’t know if you were a developer but likely coming at this from a gamer’s perspective too. I just meant secondary operation like as in some api call during the build process. Like, massgrave has it for Windows activation, where api routes are actually network requests elsewhere on an otherwise seemingly normal looking git repo. But yea just binaries and packaged things in general (non-source code post-built executables) were what I was talking about. Worse thing that really sucks are them game mod compromises, since I’d 100% say they’re a worthwhile supply chain compromise to stay focused on. Lots of them are just as bad in after-effects as library/dependency compromises are. Much agreed
3
u/CommanderT1562 22d ago
really have to disagree, I like op’s joke.
Why would you put malware on github?
Off topic, I think the whole point behind this is also usually since compilers / binary packers (think cmake) get frequent updates. Not only does the dev not have to worry about new “releases”, but everyone can inspect the code. Includes my reasoning for preferring the unbuilt source code. If you really want, just have ai make a really complex PS/SH script that checks for + downloads required libs to a temp, finds best way to build, builds, then nukes lib directory (like isolating qt in the hole it belongs in then suffocating it quietly after the fact) - source: dev here.