|
From: Tait <gnu...@t4...> - 2012-02-16 20:46:58
|
I went to try out 4.6rc today, but the only binary file available is a *.exe. What happened to the *.zip file (which I prefer)? Downloading an executable means the user must run it blindly. A zip file has the advantage that it is data, not an executable. A trusted unzip program can interpret and open the zip file, at least giving the user the chance to inspect the contents before executing code. For a program like gnuplot that doesn't actually need to execute code to install, this is unnecessary. I know "nobody" verifies MD5/SHA/signatures, but we don't provide any chance for verification, and given SourceForge compromises in the past, this makes me uncomfortable. Second, the executable can't even be used unless the user is (logged in as) an administrator, which is also unnecessary and risky. Users who are not administrators can't even reasonably use gnuplot on Windows anymore. (I don't think expecting them to compile it from source, with all the dependencies, is reasonable.) Can we bring the zip file back, at least as an additional download option, please? |