Re: No more zip file for 4.6?

[Tait <gnu...@t4...>]

To be clear, I'm not asking to eliminate the installer! I'm only asking
that we _not_ eliminate the zip file. There's room for both, I think.

> the installer was (mostly) introduced because newer windows versions
> (esp. win7) give a lot of trouble if you just unzip and run a new
> application. ...

Yes, this information is stored as part of an NTFS stream attached to
the file, and is propagated to the files after unzipping. It's trivial
to work-around (and does not require administrative rights to do so).
Just go to the file properties and click "Unblock" before unzipping. I
don't have a Vista OS anymore to try this again today, but that is how
is has worked since one of the XP service backs all the way up through
7 (and still does, at least on 7). I expect that users who have
encountered this issue are already aware of the steps to work around
it. Those who are not will quickly find the answer by searching for
"unblock zip file windows".  The issue isn't unique to gnuplot, or even
to downloaded programs in general, but applies to all
inter-security-zone transfers.

FAT filesystems don't support NTFS streams, which is why that
information is lost when you copy over to a FAT file system and back.

> Also, the added security you get from installing by a trusted unzip
> program is negligible. ...

You're partially right, of course. A targeted attack against gnuplot
specifically will be more subtle. But the issue is actually more
complex, and I was hoping to skim over it because this isn't a
security discussion forum. Just please take my word that some users
see a significant and justifiable difference in the security of a
zip file vs. an executable. (And I happen to be one such user.)

My tangent to that was a gentle suggestion that maybe we should
announce hashes of the binaries we release, which would be resistant
to even targeted attack. (Assuming the hashes weren't announced by
putting them on the same website as the executable, of course. The
mailing list is one alternative venue for widespread dissemination
of hash information.)

> You absolutely need to have administrator privileges to install a
> program..

There are different meanings of "install" at work here, I think. To
modify Windows' idea about what is installed and can be uninstalled,
one of course needs administrative privileges*. Gnuplot doesn't (or
hasn't) need(ed) to be "installed" in that sense of the word. It is
perfectly happy to run from an unzipped folder, in similar fashion
to how "portable" apps work. Users who don't care about what Windows
considers "installed" can use gnuplot as a non-administrator by un-
zipping it to their home directory and running from there.

My point was that the new installer will not even allow extracting
its contents unless the user is an administrator. And that breaks
the usage model I outlined in the paragraph above. Non-administrative
users can't get access to the bits needed to run gnuplot... at all.

* And that's not even strictly true for all configurations, but again,
I'm trying to stay mostly topical to gnuplot.

> On 20:59, Tait wrote:
> > I went to try out 4.6rc today, but the only binary file available is a
> > *.exe. What happened to the *.zip file (which I prefer)?
> > 
> > Downloading an executable means the user must run it blindly...
> > 
> > Second, the executable can't even be used unless the user is (logged in
> > as) an administrator...
> > 
> > Can we bring the zip file back, at least as an additional download option,
> > please?