Re: No more zip file for 4.6?

[Karl-Friedrich R. <mai...@gm...>]

Hi,

the installer was (mostly) intruduced because newer windows versions
(esp. win7) give a lot of trouble if you just unzip and run a new
application. The explorer will remember that the executable came
from a web download and regard it as unsafe, and ask you every time
you want to run it. If you´re no administrator, there is no way to
"unlock" it. The help file was especially troublesome in this
regard, the only way to get it to run was (in my experience) to copy
it to a fat filesystem (where it forgets its origin), and then
retrieve it from there.

Also, the added security you get from installing by a trusted unzip
program is negligible. Anybody who can taint the installer could
also meddle with any of the executables in the zip file. That is not
even "security by obscurity", you just fool yourself into thinking
you´re somewhat safer.

You absolutely need to have administrator privileges to install a
program, and it is a good thing that windows nowerdays enforces this
(or at least tries to). You never need to log in as one, win7 gets
you a "sudo" equivalent if you right-click on an executable.

So I´d say under w2k or XP the old zip-file style worked OK, but you
really gain nothing, and on win7 it´s just a lot of trouble.

Kind regards,
   Karl





On 20:59, Tait wrote:
> 
> I went to try out 4.6rc today, but the only binary file available is a
> *.exe. What happened to the *.zip file (which I prefer)?
> 
> Downloading an executable means the user must run it blindly. A zip file
> has the advantage that it is data, not an executable. A trusted unzip
> program can interpret and open the zip file, at least giving the user the
> chance to inspect the contents before executing code. For a program like
> gnuplot that doesn't actually need to execute code to install, this is
> unnecessary. I know "nobody" verifies MD5/SHA/signatures, but we don't
> provide any chance for verification, and given SourceForge compromises
> in the past, this makes me uncomfortable.
> 
> Second, the executable can't even be used unless the user is (logged in
> as) an administrator, which is also unnecessary and risky. Users who are
> not administrators can't even reasonably use gnuplot on Windows anymore.
> (I don't think expecting them to compile it from source, with all the
> dependencies, is reasonable.)
> 
> Can we bring the zip file back, at least as an additional download option,
> please?
> 
> 
> 
>