Menu
▾
▴
gnuplot-beta
|
From: Tait <gnu...@t4...> - 2012-02-16 20:46:58
|
I went to try out 4.6rc today, but the only binary file available is a *.exe. What happened to the *.zip file (which I prefer)? Downloading an executable means the user must run it blindly. A zip file has the advantage that it is data, not an executable. A trusted unzip program can interpret and open the zip file, at least giving the user the chance to inspect the contents before executing code. For a program like gnuplot that doesn't actually need to execute code to install, this is unnecessary. I know "nobody" verifies MD5/SHA/signatures, but we don't provide any chance for verification, and given SourceForge compromises in the past, this makes me uncomfortable. Second, the executable can't even be used unless the user is (logged in as) an administrator, which is also unnecessary and risky. Users who are not administrators can't even reasonably use gnuplot on Windows anymore. (I don't think expecting them to compile it from source, with all the dependencies, is reasonable.) Can we bring the zip file back, at least as an additional download option, please? |
|
From: Tatsuro M. <tma...@ya...> - 2012-02-16 22:20:02
|
Hello gp46rc1-win32-setup.exe is an installer. You can install gnuplot to any directory in which you would like to place gnuplot. BTW, there are need to old zip style distribution, it could be additional distribution style. I would like to also prepare zip style distribution for Windows binary. Regards Tatsuro --- On Fri, 2012/2/17, Tait wrote: > > I went to try out 4.6rc today, but the only binary file available is a > *.exe. What happened to the *.zip file (which I prefer)? > > Downloading an executable means the user must run it blindly. A zip file > has the advantage that it is data, not an executable. A trusted unzip > program can interpret and open the zip file, at least giving the user the > chance to inspect the contents before executing code. For a program like > gnuplot that doesn't actually need to execute code to install, this is > unnecessary. I know "nobody" verifies MD5/SHA/signatures, but we don't > provide any chance for verification, and given SourceForge compromises > in the past, this makes me uncomfortable. > > Second, the executable can't even be used unless the user is (logged in > as) an administrator, which is also unnecessary and risky. Users who are > not administrators can't even reasonably use gnuplot on Windows anymore. > (I don't think expecting them to compile it from source, with all the > dependencies, is reasonable.) > > Can we bring the zip file back, at least as an additional download option, > please? > > > > ------------------------------------------------------------------------------ > Virtualization & Cloud Management Using Capacity Planning > Cloud computing makes use of virtualization - but cloud computing > also focuses on allowing computing to be delivered as a service. > http://www.accelacomm.com/jaw/sfnl/114/51521223/ > _______________________________________________ > gnuplot-beta mailing list > gnu...@li... > https://lists.sourceforge.net/lists/listinfo/gnuplot-beta > |
|
From: Tatsuro M. <tma...@ya...> - 2012-02-16 22:35:20
|
Hello Sorry I have written the previous post without understanding what you would like to say. I can prepare zip style distribution. Is it required for 4.6-rc1? If so, I will prepare it and upload to the my web site. For the 4.6.0 release, I will also prepare zip style binary. Regards Tatsuro --- On Fri, 2012/2/17, Tatsuro MATSUOKA wrote: > Hello > > gp46rc1-win32-setup.exe is an installer. You can install gnuplot to any directory in which you would like to place gnuplot. > > BTW, there are need to old zip style distribution, it could be additional distribution style. > I would like to also prepare zip style distribution for Windows binary. > > Regards > > Tatsuro > > > --- On Fri, 2012/2/17, Tait wrote: > > > > > I went to try out 4.6rc today, but the only binary file available is a > > *.exe. What happened to the *.zip file (which I prefer)? > > > > Downloading an executable means the user must run it blindly. A zip file > > has the advantage that it is data, not an executable. A trusted unzip > > program can interpret and open the zip file, at least giving the user the > > chance to inspect the contents before executing code. For a program like > > gnuplot that doesn't actually need to execute code to install, this is > > unnecessary. I know "nobody" verifies MD5/SHA/signatures, but we don't > > provide any chance for verification, and given SourceForge compromises > > in the past, this makes me uncomfortable. > > > > Second, the executable can't even be used unless the user is (logged in > > as) an administrator, which is also unnecessary and risky. Users who are > > not administrators can't even reasonably use gnuplot on Windows anymore. > > (I don't think expecting them to compile it from source, with all the > > dependencies, is reasonable.) > > > > Can we bring the zip file back, at least as an additional download option, > > please? > > > > > > > > ------------------------------------------------------------------------------ > > Virtualization & Cloud Management Using Capacity Planning > > Cloud computing makes use of virtualization - but cloud computing > > also focuses on allowing computing to be delivered as a service. > > http://www.accelacomm.com/jaw/sfnl/114/51521223/ > > _______________________________________________ > > gnuplot-beta mailing list > > gnu...@li... > > https://lists.sourceforge.net/lists/listinfo/gnuplot-beta > > > > ------------------------------------------------------------------------------ > Virtualization & Cloud Management Using Capacity Planning > Cloud computing makes use of virtualization - but cloud computing > also focuses on allowing computing to be delivered as a service. > http://www.accelacomm.com/jaw/sfnl/114/51521223/ > _______________________________________________ > gnuplot-beta mailing list > gnu...@li... > https://lists.sourceforge.net/lists/listinfo/gnuplot-beta > |
|
From: Tatsuro M. <tma...@ya...> - 2012-02-16 23:09:40
|
Hello I have prepared zip style distribution. http://www.tatsuromatsuoka.com/gnuplot/Eng/gp46/ Regards Tatsuro --- On Fri, 2012/2/17, Tatsuro MATSUOKA > wrote: > Hello > > Sorry I have written the previous post without understanding what you would like to say. > > I can prepare zip style distribution. Is it required for 4.6-rc1? > If so, I will prepare it and upload to the my web site. > > For the 4.6.0 release, I will also prepare zip style binary. > > Regards > > Tatsuro > > --- On Fri, 2012/2/17, Tatsuro MATSUOKA wrote: > > > Hello > > > > gp46rc1-win32-setup.exe is an installer. You can install gnuplot to any directory in which you would like to place gnuplot. > > > > BTW, there are need to old zip style distribution, it could be additional distribution style. > > I would like to also prepare zip style distribution for Windows binary. > > > > Regards > > > > Tatsuro > > > > > > --- On Fri, 2012/2/17, Tait wrote: > > > > > > > > I went to try out 4.6rc today, but the only binary file available is a > > > *.exe. What happened to the *.zip file (which I prefer)? > > > > > > Downloading an executable means the user must run it blindly. A zip file > > > has the advantage that it is data, not an executable. A trusted unzip > > > program can interpret and open the zip file, at least giving the user the > > > chance to inspect the contents before executing code. For a program like > > > gnuplot that doesn't actually need to execute code to install, this is > > > unnecessary. I know "nobody" verifies MD5/SHA/signatures, but we don't > > > provide any chance for verification, and given SourceForge compromises > > > in the past, this makes me uncomfortable. > > > > > > Second, the executable can't even be used unless the user is (logged in > > > as) an administrator, which is also unnecessary and risky. Users who are > > > not administrators can't even reasonably use gnuplot on Windows anymore. > > > (I don't think expecting them to compile it from source, with all the > > > dependencies, is reasonable.) > > > > > > Can we bring the zip file back, at least as an additional download option, > > > please? > > > > > > > > > > > > ------------------------------------------------------------------------------ > > > Virtualization & Cloud Management Using Capacity Planning > > > Cloud computing makes use of virtualization - but cloud computing > > > also focuses on allowing computing to be delivered as a service. > > > http://www.accelacomm.com/jaw/sfnl/114/51521223/ > > > _______________________________________________ > > > gnuplot-beta mailing list > > > gnu...@li... > > > https://lists.sourceforge.net/lists/listinfo/gnuplot-beta > > > > > > > ------------------------------------------------------------------------------ > > Virtualization & Cloud Management Using Capacity Planning > > Cloud computing makes use of virtualization - but cloud computing > > also focuses on allowing computing to be delivered as a service. > > http://www.accelacomm.com/jaw/sfnl/114/51521223/ > > _______________________________________________ > > gnuplot-beta mailing list > > gnu...@li... > > https://lists.sourceforge.net/lists/listinfo/gnuplot-beta > > > > ------------------------------------------------------------------------------ > Virtualization & Cloud Management Using Capacity Planning > Cloud computing makes use of virtualization - but cloud computing > also focuses on allowing computing to be delivered as a service. > http://www.accelacomm.com/jaw/sfnl/114/51521223/ > _______________________________________________ > gnuplot-beta mailing list > gnu...@li... > https://lists.sourceforge.net/lists/listinfo/gnuplot-beta > |
|
From: Tait <gnu...@t4...> - 2012-02-21 09:46:25
|
It's taken me a while to get back to this. The zip file from your link appears to be dead. > Hello > > I have prepared zip style distribution. > > http://www.tatsuromatsuoka.com/gnuplot/Eng/gp46/ > > Regards > > Tatsuro > > > --- On Fri, 2012/2/17, Tatsuro MATSUOKA wrote: > > > Hello > > > > > > gp46rc1-win32-setup.exe is an installer. You can install gnuplot to any directory in which you would like to place gnuplot. > > > > > > BTW, there are need to old zip style distribution, it could be additional distribution style. > > > I would like to also prepare zip style distribution for Windows binary. > > > > > > Regards > > > > > > Tatsuro > > > > > > > > > --- On Fri, 2012/2/17, Tait wrote: > > > > > > > > > > > I went to try out 4.6rc today, but the only binary file available is a > > > > *.exe. What happened to the *.zip file (which I prefer)? > > > > > > > > Downloading an executable means the user must run it blindly. A zip file > > > > has the advantage that it is data, not an executable. A trusted unzip > > > > program can interpret and open the zip file, at least giving the user the > > > > chance to inspect the contents before executing code. For a program like > > > > gnuplot that doesn't actually need to execute code to install, this is > > > > unnecessary. I know "nobody" verifies MD5/SHA/signatures, but we don't > > > > provide any chance for verification, and given SourceForge compromises > > > > in the past, this makes me uncomfortable. > > > > > > > > Second, the executable can't even be used unless the user is (logged in > > > > as) an administrator, which is also unnecessary and risky. Users who are > > > > not administrators can't even reasonably use gnuplot on Windows anymore. > > > > (I don't think expecting them to compile it from source, with all the > > > > dependencies, is reasonable.) > > > > > > > > Can we bring the zip file back, at least as an additional download option, > > > > please? > > > > > > > > > > > > > > > > ------------------------------------------------------------------------------ > > > > Virtualization & Cloud Management Using Capacity Planning > > > > Cloud computing makes use of virtualization - but cloud computing > > > > also focuses on allowing computing to be delivered as a service. > > > > http://www.accelacomm.com/jaw/sfnl/114/51521223/ > > > > _______________________________________________ > > > > gnuplot-beta mailing list > > > > gnu...@li... > > > > https://lists.sourceforge.net/lists/listinfo/gnuplot-beta > > > > > > > > > > ------------------------------------------------------------------------------ > > > Virtualization & Cloud Management Using Capacity Planning > > > Cloud computing makes use of virtualization - but cloud computing > > > also focuses on allowing computing to be delivered as a service. > > > http://www.accelacomm.com/jaw/sfnl/114/51521223/ > > > _______________________________________________ > > > gnuplot-beta mailing list > > > gnu...@li... > > > https://lists.sourceforge.net/lists/listinfo/gnuplot-beta > > > > > > > ------------------------------------------------------------------------------ > > Virtualization & Cloud Management Using Capacity Planning > > Cloud computing makes use of virtualization - but cloud computing > > also focuses on allowing computing to be delivered as a service. > > http://www.accelacomm.com/jaw/sfnl/114/51521223/ > > _______________________________________________ > > gnuplot-beta mailing list > > gnu...@li... > > https://lists.sourceforge.net/lists/listinfo/gnuplot-beta > > |
|
From: Tatsuro M. <tma...@ya...> - 2012-02-21 22:15:26
|
--- On Tue, 2012/2/21, Tait wrote: > > It's taken me a while to get back to this. The zip file from your link appears to be dead. > > > > > Hello > > > > I have prepared zip style distribution. > > > > http://www.tatsuromatsuoka.com/gnuplot/Eng/gp46/ > > > > Regards > > > > Tatsuro > > > > > --- On Fri, 2012/2/17, Tatsuro MATSUOKA wrote: > > > > Hello > > > > > > > > gp46rc1-win32-setup.exe is an installer. You can install gnuplot to any directory in which you would like to place gnuplot. > > > > > > > > BTW, there are need to old zip style distribution, it could be additional distribution style. > > > > I would like to also prepare zip style distribution for Windows binary. > > > > > > > > Regards > > > > > > > > Tatsuro > > > > > > > > > > > > --- On Fri, 2012/2/17, Tait wrote: > > > > > > > > > > > > > > I went to try out 4.6rc today, but the only binary file available is a > > > > > *.exe. What happened to the *.zip file (which I prefer)? > > > > > > > > > > Downloading an executable means the user must run it blindly. A zip file > > > > > has the advantage that it is data, not an executable. A trusted unzip > > > > > program can interpret and open the zip file, at least giving the user the > > > > > chance to inspect the contents before executing code. For a program like > > > > > gnuplot that doesn't actually need to execute code to install, this is > > > > > unnecessary. I know "nobody" verifies MD5/SHA/signatures, but we don't > > > > > provide any chance for verification, and given SourceForge compromises > > > > > in the past, this makes me uncomfortable. > > > > > > > > > > Second, the executable can't even be used unless the user is (logged in > > > > > as) an administrator, which is also unnecessary and risky. Users who are > > > > > not administrators can't even reasonably use gnuplot on Windows anymore. > > > > > (I don't think expecting them to compile it from source, with all the > > > > > dependencies, is reasonable.) > > > > > > > > > > Can we bring the zip file back, at least as an additional download option, > > > > > please? > > > > > > > > > > > > > > > > > > > > Hello Sorry I have corrected the link. Perhaps this time is OK. Can you confirm download? Regards Tatsuro |
|
From: Tait <gnu...@t4...> - 2012-02-22 00:16:27
|
Works now, and at least starts up. Thanks! > Sorry I have corrected the link. > Perhaps this time is OK. > > Can you confirm download? > > > It's taken me a while to get back to this. The zip file from your link appears to be dead. > > > > > I have prepared zip style distribution. > > > http://www.tatsuromatsuoka.com/gnuplot/Eng/gp46/ > > > > > > > > I would like to also prepare zip style distribution for Windows binary. > > > > > > > > > > > I went to try out 4.6rc today, but the only binary file available is a > > > > > > *.exe. What happened to the *.zip file (which I prefer)? |
|
From: Karl-Friedrich R. <mai...@gm...> - 2012-02-17 19:38:28
|
Hi, the installer was (mostly) intruduced because newer windows versions (esp. win7) give a lot of trouble if you just unzip and run a new application. The explorer will remember that the executable came from a web download and regard it as unsafe, and ask you every time you want to run it. If you´re no administrator, there is no way to "unlock" it. The help file was especially troublesome in this regard, the only way to get it to run was (in my experience) to copy it to a fat filesystem (where it forgets its origin), and then retrieve it from there. Also, the added security you get from installing by a trusted unzip program is negligible. Anybody who can taint the installer could also meddle with any of the executables in the zip file. That is not even "security by obscurity", you just fool yourself into thinking you´re somewhat safer. You absolutely need to have administrator privileges to install a program, and it is a good thing that windows nowerdays enforces this (or at least tries to). You never need to log in as one, win7 gets you a "sudo" equivalent if you right-click on an executable. So I´d say under w2k or XP the old zip-file style worked OK, but you really gain nothing, and on win7 it´s just a lot of trouble. Kind regards, Karl On 20:59, Tait wrote: > > I went to try out 4.6rc today, but the only binary file available is a > *.exe. What happened to the *.zip file (which I prefer)? > > Downloading an executable means the user must run it blindly. A zip file > has the advantage that it is data, not an executable. A trusted unzip > program can interpret and open the zip file, at least giving the user the > chance to inspect the contents before executing code. For a program like > gnuplot that doesn't actually need to execute code to install, this is > unnecessary. I know "nobody" verifies MD5/SHA/signatures, but we don't > provide any chance for verification, and given SourceForge compromises > in the past, this makes me uncomfortable. > > Second, the executable can't even be used unless the user is (logged in > as) an administrator, which is also unnecessary and risky. Users who are > not administrators can't even reasonably use gnuplot on Windows anymore. > (I don't think expecting them to compile it from source, with all the > dependencies, is reasonable.) > > Can we bring the zip file back, at least as an additional download option, > please? > > > > |
|
From: Tait <gnu...@t4...> - 2012-02-21 10:22:17
|
To be clear, I'm not asking to eliminate the installer! I'm only asking that we _not_ eliminate the zip file. There's room for both, I think. > the installer was (mostly) introduced because newer windows versions > (esp. win7) give a lot of trouble if you just unzip and run a new > application. ... Yes, this information is stored as part of an NTFS stream attached to the file, and is propagated to the files after unzipping. It's trivial to work-around (and does not require administrative rights to do so). Just go to the file properties and click "Unblock" before unzipping. I don't have a Vista OS anymore to try this again today, but that is how is has worked since one of the XP service backs all the way up through 7 (and still does, at least on 7). I expect that users who have encountered this issue are already aware of the steps to work around it. Those who are not will quickly find the answer by searching for "unblock zip file windows". The issue isn't unique to gnuplot, or even to downloaded programs in general, but applies to all inter-security-zone transfers. FAT filesystems don't support NTFS streams, which is why that information is lost when you copy over to a FAT file system and back. > Also, the added security you get from installing by a trusted unzip > program is negligible. ... You're partially right, of course. A targeted attack against gnuplot specifically will be more subtle. But the issue is actually more complex, and I was hoping to skim over it because this isn't a security discussion forum. Just please take my word that some users see a significant and justifiable difference in the security of a zip file vs. an executable. (And I happen to be one such user.) My tangent to that was a gentle suggestion that maybe we should announce hashes of the binaries we release, which would be resistant to even targeted attack. (Assuming the hashes weren't announced by putting them on the same website as the executable, of course. The mailing list is one alternative venue for widespread dissemination of hash information.) > You absolutely need to have administrator privileges to install a > program.. There are different meanings of "install" at work here, I think. To modify Windows' idea about what is installed and can be uninstalled, one of course needs administrative privileges*. Gnuplot doesn't (or hasn't) need(ed) to be "installed" in that sense of the word. It is perfectly happy to run from an unzipped folder, in similar fashion to how "portable" apps work. Users who don't care about what Windows considers "installed" can use gnuplot as a non-administrator by un- zipping it to their home directory and running from there. My point was that the new installer will not even allow extracting its contents unless the user is an administrator. And that breaks the usage model I outlined in the paragraph above. Non-administrative users can't get access to the bits needed to run gnuplot... at all. * And that's not even strictly true for all configurations, but again, I'm trying to stay mostly topical to gnuplot. > On 20:59, Tait wrote: > > I went to try out 4.6rc today, but the only binary file available is a > > *.exe. What happened to the *.zip file (which I prefer)? > > > > Downloading an executable means the user must run it blindly... > > > > Second, the executable can't even be used unless the user is (logged in > > as) an administrator... > > > > Can we bring the zip file back, at least as an additional download option, > > please? |
