▲ -15 ▼ Wid: My package manager project (github.com) submitted 2 months ago by ZeSystem@programming.dev to c/rust@programming.dev 37 comments fedilink hide all child comments Wid: My package manager project Hi guys, This is my package manager project. Wid, as the name implies is a Windows Downloader. My project is open-source and GPL v3 license. You can figure out the rest by experimenting. You can learn the commands by entering the "wid" command into cmd. Repo: https://github.com/ZeSystem-Inc/wid Releases: https://github.com/ZeSystem-Inc/wid/releases
[–] ZeSystem@programming.dev [S] -1 points 2 months ago (12 children) Actually, it's not static. I'm updating the package list. permalink fedilink source parent hideshow 12 child comments replies: [–] CameronDev@programming.dev 3 points 2 months ago (8 children) Updating the gist gives a new URL no? permalink fedilink source parent hideshow 8 child comments replies: [–] ZeSystem@programming.dev [S] -2 points 2 months ago No, when I edit the gist, the URL doesn't change. There are 32 packages right now. I've just added Epic Games. I use GitHub Gist. permalink fedilink source parent [–] ZeSystem@programming.dev [S] -4 points 2 months ago (6 children) I think you should use wid. I already use my own download tool. It's better than winget, choco, and ninite. permalink fedilink source parent hideshow 6 child comments replies: [–] CameronDev@programming.dev 9 points 2 months ago (5 children) Better is a wild claim. You're right, gists do seem to update with the static url, however that isnt necessarily better, it now means your gist is effectively under your control, and you can replace the installers with malware packed ones. Operating a software repository/installer requires that people trust you, and that is basically impossible for a no-name dev with no history. You ideally should be doing checksum checks as well. permalink fedilink source parent hideshow 5 child comments replies: [–] ZeSystem@programming.dev [S] -2 points 2 months ago (4 children) I use official links and check versions. permalink fedilink source parent hideshow 4 child comments replies: [–] CameronDev@programming.dev 6 points 2 months ago (3 children) Sure, you might today, but tomorrow? How can anyone trust that you wont start serving malicious links? permalink fedilink source parent hideshow 3 child comments replies: [–] ZeSystem@programming.dev [S] 0 points 2 months ago (2 children) It's open source. Anyone can audit it. You can create your own sources.list, but if you distribute it, you must open the code. Also, "wid info <package_name>" shows the exact URL it downloads from. Example: wid info llvm shows the official GitHub release link. permalink fedilink source parent hideshow 2 child comments replies: [–] CameronDev@programming.dev 4 points 2 months ago (1 child) Thats how it works in theory, but in practice it comes down to trust more than anything else. Its more effort to read and validate your list than it is to just go and download the installer directly. So you need people to trust you. permalink fedilink source parent hideshow 1 child comment replies: [–] ZeSystem@programming.dev [S] 1 point 2 months ago You're absolutely right. Trust is the real challenge, and I'm just starting to earn it. That's why I keep everything open and plan to add checksum verification. I know it takes time. I'm in it for the long run. permalink fedilink source parent [–] one_old_coder@piefed.social 1 point 2 months ago (2 children) it’s not static It is static. Please stop, it's embarrassing. permalink fedilink source parent hideshow 2 child comments replies: [–] ZeSystem@programming.dev [S] -1 points 2 months ago (1 child) The URL is static. The content is dynamic because I update the Gist. That's how Gist works. permalink fedilink source parent hideshow 1 child comment replies: [–] one_old_coder@piefed.social 2 points 2 months ago* And it's a very bad and dangerous idea, I'll leave it as an exercice to the reader. permalink fedilink source parent
[–] CameronDev@programming.dev 3 points 2 months ago (8 children) Updating the gist gives a new URL no? permalink fedilink source parent hideshow 8 child comments replies: [–] ZeSystem@programming.dev [S] -2 points 2 months ago No, when I edit the gist, the URL doesn't change. There are 32 packages right now. I've just added Epic Games. I use GitHub Gist. permalink fedilink source parent [–] ZeSystem@programming.dev [S] -4 points 2 months ago (6 children) I think you should use wid. I already use my own download tool. It's better than winget, choco, and ninite. permalink fedilink source parent hideshow 6 child comments replies: [–] CameronDev@programming.dev 9 points 2 months ago (5 children) Better is a wild claim. You're right, gists do seem to update with the static url, however that isnt necessarily better, it now means your gist is effectively under your control, and you can replace the installers with malware packed ones. Operating a software repository/installer requires that people trust you, and that is basically impossible for a no-name dev with no history. You ideally should be doing checksum checks as well. permalink fedilink source parent hideshow 5 child comments replies: [–] ZeSystem@programming.dev [S] -2 points 2 months ago (4 children) I use official links and check versions. permalink fedilink source parent hideshow 4 child comments replies: [–] CameronDev@programming.dev 6 points 2 months ago (3 children) Sure, you might today, but tomorrow? How can anyone trust that you wont start serving malicious links? permalink fedilink source parent hideshow 3 child comments replies: [–] ZeSystem@programming.dev [S] 0 points 2 months ago (2 children) It's open source. Anyone can audit it. You can create your own sources.list, but if you distribute it, you must open the code. Also, "wid info <package_name>" shows the exact URL it downloads from. Example: wid info llvm shows the official GitHub release link. permalink fedilink source parent hideshow 2 child comments replies: [–] CameronDev@programming.dev 4 points 2 months ago (1 child) Thats how it works in theory, but in practice it comes down to trust more than anything else. Its more effort to read and validate your list than it is to just go and download the installer directly. So you need people to trust you. permalink fedilink source parent hideshow 1 child comment replies: [–] ZeSystem@programming.dev [S] 1 point 2 months ago You're absolutely right. Trust is the real challenge, and I'm just starting to earn it. That's why I keep everything open and plan to add checksum verification. I know it takes time. I'm in it for the long run. permalink fedilink source parent
[–] ZeSystem@programming.dev [S] -2 points 2 months ago No, when I edit the gist, the URL doesn't change. There are 32 packages right now. I've just added Epic Games. I use GitHub Gist. permalink fedilink source parent
[–] ZeSystem@programming.dev [S] -4 points 2 months ago (6 children) I think you should use wid. I already use my own download tool. It's better than winget, choco, and ninite. permalink fedilink source parent hideshow 6 child comments replies: [–] CameronDev@programming.dev 9 points 2 months ago (5 children) Better is a wild claim. You're right, gists do seem to update with the static url, however that isnt necessarily better, it now means your gist is effectively under your control, and you can replace the installers with malware packed ones. Operating a software repository/installer requires that people trust you, and that is basically impossible for a no-name dev with no history. You ideally should be doing checksum checks as well. permalink fedilink source parent hideshow 5 child comments replies: [–] ZeSystem@programming.dev [S] -2 points 2 months ago (4 children) I use official links and check versions. permalink fedilink source parent hideshow 4 child comments replies: [–] CameronDev@programming.dev 6 points 2 months ago (3 children) Sure, you might today, but tomorrow? How can anyone trust that you wont start serving malicious links? permalink fedilink source parent hideshow 3 child comments replies: [–] ZeSystem@programming.dev [S] 0 points 2 months ago (2 children) It's open source. Anyone can audit it. You can create your own sources.list, but if you distribute it, you must open the code. Also, "wid info <package_name>" shows the exact URL it downloads from. Example: wid info llvm shows the official GitHub release link. permalink fedilink source parent hideshow 2 child comments replies: [–] CameronDev@programming.dev 4 points 2 months ago (1 child) Thats how it works in theory, but in practice it comes down to trust more than anything else. Its more effort to read and validate your list than it is to just go and download the installer directly. So you need people to trust you. permalink fedilink source parent hideshow 1 child comment replies: [–] ZeSystem@programming.dev [S] 1 point 2 months ago You're absolutely right. Trust is the real challenge, and I'm just starting to earn it. That's why I keep everything open and plan to add checksum verification. I know it takes time. I'm in it for the long run. permalink fedilink source parent
[–] CameronDev@programming.dev 9 points 2 months ago (5 children) Better is a wild claim. You're right, gists do seem to update with the static url, however that isnt necessarily better, it now means your gist is effectively under your control, and you can replace the installers with malware packed ones. Operating a software repository/installer requires that people trust you, and that is basically impossible for a no-name dev with no history. You ideally should be doing checksum checks as well. permalink fedilink source parent hideshow 5 child comments replies: [–] ZeSystem@programming.dev [S] -2 points 2 months ago (4 children) I use official links and check versions. permalink fedilink source parent hideshow 4 child comments replies: [–] CameronDev@programming.dev 6 points 2 months ago (3 children) Sure, you might today, but tomorrow? How can anyone trust that you wont start serving malicious links? permalink fedilink source parent hideshow 3 child comments replies: [–] ZeSystem@programming.dev [S] 0 points 2 months ago (2 children) It's open source. Anyone can audit it. You can create your own sources.list, but if you distribute it, you must open the code. Also, "wid info <package_name>" shows the exact URL it downloads from. Example: wid info llvm shows the official GitHub release link. permalink fedilink source parent hideshow 2 child comments replies: [–] CameronDev@programming.dev 4 points 2 months ago (1 child) Thats how it works in theory, but in practice it comes down to trust more than anything else. Its more effort to read and validate your list than it is to just go and download the installer directly. So you need people to trust you. permalink fedilink source parent hideshow 1 child comment replies: [–] ZeSystem@programming.dev [S] 1 point 2 months ago You're absolutely right. Trust is the real challenge, and I'm just starting to earn it. That's why I keep everything open and plan to add checksum verification. I know it takes time. I'm in it for the long run. permalink fedilink source parent
[–] ZeSystem@programming.dev [S] -2 points 2 months ago (4 children) I use official links and check versions. permalink fedilink source parent hideshow 4 child comments replies: [–] CameronDev@programming.dev 6 points 2 months ago (3 children) Sure, you might today, but tomorrow? How can anyone trust that you wont start serving malicious links? permalink fedilink source parent hideshow 3 child comments replies: [–] ZeSystem@programming.dev [S] 0 points 2 months ago (2 children) It's open source. Anyone can audit it. You can create your own sources.list, but if you distribute it, you must open the code. Also, "wid info <package_name>" shows the exact URL it downloads from. Example: wid info llvm shows the official GitHub release link. permalink fedilink source parent hideshow 2 child comments replies: [–] CameronDev@programming.dev 4 points 2 months ago (1 child) Thats how it works in theory, but in practice it comes down to trust more than anything else. Its more effort to read and validate your list than it is to just go and download the installer directly. So you need people to trust you. permalink fedilink source parent hideshow 1 child comment replies: [–] ZeSystem@programming.dev [S] 1 point 2 months ago You're absolutely right. Trust is the real challenge, and I'm just starting to earn it. That's why I keep everything open and plan to add checksum verification. I know it takes time. I'm in it for the long run. permalink fedilink source parent
[–] CameronDev@programming.dev 6 points 2 months ago (3 children) Sure, you might today, but tomorrow? How can anyone trust that you wont start serving malicious links? permalink fedilink source parent hideshow 3 child comments replies: [–] ZeSystem@programming.dev [S] 0 points 2 months ago (2 children) It's open source. Anyone can audit it. You can create your own sources.list, but if you distribute it, you must open the code. Also, "wid info <package_name>" shows the exact URL it downloads from. Example: wid info llvm shows the official GitHub release link. permalink fedilink source parent hideshow 2 child comments replies: [–] CameronDev@programming.dev 4 points 2 months ago (1 child) Thats how it works in theory, but in practice it comes down to trust more than anything else. Its more effort to read and validate your list than it is to just go and download the installer directly. So you need people to trust you. permalink fedilink source parent hideshow 1 child comment replies: [–] ZeSystem@programming.dev [S] 1 point 2 months ago You're absolutely right. Trust is the real challenge, and I'm just starting to earn it. That's why I keep everything open and plan to add checksum verification. I know it takes time. I'm in it for the long run. permalink fedilink source parent
[–] ZeSystem@programming.dev [S] 0 points 2 months ago (2 children) It's open source. Anyone can audit it. You can create your own sources.list, but if you distribute it, you must open the code. Also, "wid info <package_name>" shows the exact URL it downloads from. Example: wid info llvm shows the official GitHub release link. permalink fedilink source parent hideshow 2 child comments replies: [–] CameronDev@programming.dev 4 points 2 months ago (1 child) Thats how it works in theory, but in practice it comes down to trust more than anything else. Its more effort to read and validate your list than it is to just go and download the installer directly. So you need people to trust you. permalink fedilink source parent hideshow 1 child comment replies: [–] ZeSystem@programming.dev [S] 1 point 2 months ago You're absolutely right. Trust is the real challenge, and I'm just starting to earn it. That's why I keep everything open and plan to add checksum verification. I know it takes time. I'm in it for the long run. permalink fedilink source parent
[–] CameronDev@programming.dev 4 points 2 months ago (1 child) Thats how it works in theory, but in practice it comes down to trust more than anything else. Its more effort to read and validate your list than it is to just go and download the installer directly. So you need people to trust you. permalink fedilink source parent hideshow 1 child comment replies: [–] ZeSystem@programming.dev [S] 1 point 2 months ago You're absolutely right. Trust is the real challenge, and I'm just starting to earn it. That's why I keep everything open and plan to add checksum verification. I know it takes time. I'm in it for the long run. permalink fedilink source parent
[–] ZeSystem@programming.dev [S] 1 point 2 months ago You're absolutely right. Trust is the real challenge, and I'm just starting to earn it. That's why I keep everything open and plan to add checksum verification. I know it takes time. I'm in it for the long run. permalink fedilink source parent
[–] one_old_coder@piefed.social 1 point 2 months ago (2 children) it’s not static It is static. Please stop, it's embarrassing. permalink fedilink source parent hideshow 2 child comments replies: [–] ZeSystem@programming.dev [S] -1 points 2 months ago (1 child) The URL is static. The content is dynamic because I update the Gist. That's how Gist works. permalink fedilink source parent hideshow 1 child comment replies: [–] one_old_coder@piefed.social 2 points 2 months ago* And it's a very bad and dangerous idea, I'll leave it as an exercice to the reader. permalink fedilink source parent
[–] ZeSystem@programming.dev [S] -1 points 2 months ago (1 child) The URL is static. The content is dynamic because I update the Gist. That's how Gist works. permalink fedilink source parent hideshow 1 child comment replies: [–] one_old_coder@piefed.social 2 points 2 months ago* And it's a very bad and dangerous idea, I'll leave it as an exercice to the reader. permalink fedilink source parent
[–] one_old_coder@piefed.social 2 points 2 months ago* And it's a very bad and dangerous idea, I'll leave it as an exercice to the reader. permalink fedilink source parent