Mailing-List: contact flex-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: flex-dev@incubator.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
MIME-Version: 1.0
In-Reply-To: 
 <CAEWfVJk1dO3pfAZysq1fwab8VQvwXDj3fTaqfBC7Gdp6OUZcFw@mail.gmail.com>
References: 
 <CACK5iZeyezdX_Mpwzig2RDYWBEoQiBO-cBimnaixyPFxS_m+jw@mail.gmail.com>
	<CAEWfVJmWxswFMWUzACP_VwWsWmm3u6yy_ZyeNnd+C98MwWYceQ@mail.gmail.com>
	<CAJs+wW35-avC6m9+vGV=OwPmj+bXE+JZCy8uTGtutg7AG3_fJw@mail.gmail.com>
	<CAEWfVJmNwgu3S4i6srPSMMWn6bwZFrR-1KkcFGg4ibJOUWW0RQ@mail.gmail.com>
	<CAJs+wW3ZUSeWB8YN3qf=LyFjXwhVJfyD4EpS2C0+8OXwOuv2Cg@mail.gmail.com>
	<CAEWfVJk1dO3pfAZysq1fwab8VQvwXDj3fTaqfBC7Gdp6OUZcFw@mail.gmail.com>
Date: Wed, 26 Sep 2012 07:37:23 -0400
Message-ID: 
 <CALorpXcEA2cmeneeS52kxL8ngS=RkL1oCzAgO+ha2khqRTCJNA@mail.gmail.com>
Subject: Re: [VOTE] Release InstallApacheFlex 1.0 - RC5
From: Nicholas Kwiatkowski <nicholas@spoon.as>
To: flex-dev@incubator.apache.org
Content-Type: multipart/alternative; boundary=000e0cd1e22212272b04ca993f4d

--000e0cd1e22212272b04ca993f4d
Content-Type: text/plain; charset=ISO-8859-1

>From what I understand, that app does verify the MD5 of the downloaded
files from mirrors -- so in effect, it is verifying that the downloads are
authentic enough that they are "singed" by us.

I don't believe the Adobe downloads are signed, nor are MD5 checked.  I
don't know if that is of concern, but we don't provide the MD5 checks for
those downloads using our normal, manual process.  Adobe has the right to
update those prerequisites without letting us know, which may cause issues
if we do MD5 checking.

As far as a notice that files are being downloaded -- that is exactly it.
 They are being downloaded and extracted.  They are not being 'installed'
onto the system.  Installed in my mind says that binaries are set to be run
by the OS, with stuff in the start menu (or applications folder), etc.
 That is NOT what this utility does.  It simply grabs all the prerequisites
from the 15 or so locations we require them from, and extracts them in the
correct format onto the user's PC.  Nothing more happens without the user
moving forward.

Personally, I'm at the stance that we should get this out the door.  It is
functioning as expected, and while we could belabor the user to death with
1,000 more warnings, I don't think they need it.

-Nick

On Wed, Sep 26, 2012 at 4:19 AM, Bertrand Delacretaz <bdelacretaz@apache.org
> wrote:

> Hi,
>
> On Wed, Sep 26, 2012 at 9:47 AM, Erik de Bruin <erik@ixsoftware.nl> wrote:
> > This is starting to feel like the never-ending [VOTE] :( Are all
> > releases going to be like this, or will it get better (smoother, less
> > frustrating) later on?...
>
> I understand your frustration, sorry that I didn't notice the
> FLEX-33210 problem earlier, but as I said i'm very surprised that no
> one else here seems to be bothered by Flex software blindly installing
> stuff on user's boxes.
>
> If it's just my opinion and a few others say that they don't care
> about releasing the installer with  FLEX-33210 unresolved, I'll accept
> that.
>
> > ...I honestly feel that adding another dialog to the program
> > will do nothing to educate the user - after all, who really reads
> > them, you click OK and get on with what you came to the installer for,
> > downloading the SDK - I see the legal reasoning behind it and agree,
> > reluctantly, that it should be included in the software....
>
> It's not a legal matter as far as I'm concerned, more a quality issue,
> I personally don't want any Apache software to install stuff on user's
> boxes without giving them the opportunity to check what's happening
> beforeheand.
>
> >
> > Om, if feel an RC6 (!) coming up in the near future...
>
> Let's see what others think about  FLEX-33210 - mentors for example?
>
> -Bertrand
>

--000e0cd1e22212272b04ca993f4d--