winchrome VS winget-pkgs

Hey, Congratulations on your upgrade to Windows 7!

Not 48 hours ago, I spoke highly of the benefits of Windows 7[1], as a user myself.

It is absolutely possible to use Windows 7 reasonably securely, if you take the appropriate precautions(again, see my comment)

> I can use the latest versions of Google Chrome

Firefox? Yes. Chrome? No.

Chromium 109 is the last version to support Windows 7. Here's the last working ungoogled variant [2].

Switch to LibreWolf[3] Firefox based browser with user.js modifications[3] pre-installed. Or if you don't trust librewolf, use Firefox and manually add the same user.js[4]

It's better for security than Chrome could ever hope to be.

Your web browser's javascript continue to be the predominant way for malware to make its entry. So just make sure to take the appropriate security precautions, as mentioned in my comment [1].

> When Firefox stopped receiving upgrades I switched to Mypal browser, an open source browser specially made for Windows XP. It is cruder than Google Chrome but does the job most of the time.

Have you tried K-Meleon on Windows XP[5]? It's Old Firefox(pre-Australis) based, and still gets updates.

Windows 7 is the last legit good Microsoft Operating System.

It truly is a wonder and a delight to use and modify.

Anyway, all the very best on your Windows 7 journey. May it serve you well.

Cheers!

[1] https://news.ycombinator.com/item?id=35431587

[2] https://github.com/macchrome/winchrome/releases/tag/v109.541...

[3] https://librewolf.net/installation/windows/

[4] https://github.com/arkenfox/user.js/blob/master/user.js

[5] https://kmeleonbrowser.org

v109.0.5414.120-r1070088 (Ungoogled, 25 Jan 2023) Marmaduke • up-to-date • ungoogled • widevine • all-codecs+ • win64 • Portable • Archive • Installer

I use vivaldi and this: https://github.com/macchrome/winchrome/releases

What is this? https://github.com/ungoogled-software/ungoogled-chromium-windows Is this versions not at chromium.woolyss.com? It's not the Marmaduke version, which is at https://github.com/macchrome/winchrome Is that the version the Marmaduke build is based on (with some added features)?

Ungoogled Chromium Binaries: https://github.com/macchrome/winchrome/releases, or https://chromium.woolyss.com/

I have been directly affected by it. It turns out the binaries distributed via winget on windows come from an apparently reliable source (https://github.com/macchrome/winchrome/releases) that has even changed some browser features. I found it out when I saw a button saying 'black' instead of 'back' on a 'confirm form resubmission' dialog box. I dug deeper and reproduced it with the help of a UG dev.

I'm using Windows version, but there's also Linux version in another repo. https://github.com/macchrome/winchrome/releases/tag/v102.0.5005.63-6-r992738-Win64

Consider ungoogled chromium as an alternative (it still has the win11 style menu flag!): https://github.com/macchrome/winchrome/releases

here https://github.com/macchrome/winchrome/releases are the very latest versions of ungoogled chromium binaries(94.0.4606.81). You can even see the source code to verify yourself.

7.0 is now available: https://github.com/microsoft/winget-pkgs/pull/147886

I researched this for a WinGet thing: https://github.com/microsoft/winget-pkgs/pull/110618

Ah, reminds me of that time I requested a .editorconfig file in a Microsoft repo: https://github.com/microsoft/winget-pkgs/issues/329

Take dropbox as an example. This is what the yaml manifest looks like for that if you install it through winget. It literally has a hardcoded link to an .exe installer hosted by dropbox and then just set the flags to silent. I am not spreading misinformation, you are.

It's not quite the same though, as there are different considerations when using a repository of things a unified group has decided should be included and built (or slightly modified existing) packages for and a repo where anyone can submit a package that will go through some level of vetting. In the end I still believe most this discussion is really about individuals and how much trust they apply towards different groups and sources and is not really about Linux or Windows in particular as much.

1: https://github.com/microsoft/winget-pkgs

I never used winget, but probably: - https://github.com/microsoft/winget-pkgs/issues/107858 - https://github.com/Genymobile/scrcpy/issues/4027

It's probably not on the Store, winget pulls from both the Store and a community collection of manifests on GitHub: https://github.com/microsoft/winget-pkgs

I think that's part of the problem, if you don't have that package manager to bootstrap your signature key ring, DNS is your next best bootstrap. It is, of course, a terrible bootstrap for trust, but it is one so many users on Windows have been relying on for such a long time.

For power users on any modern Windows 10/Windows 11 there is at least WinGet now. Its manifests repo is becoming a very interesting (open) source of truth for common Windows applications. Admittedly, it in most cases doesn't seem to be checking specific code signatures in most cases either, but at least includes SHA checksums.

For instance, 7zip's manifests: https://github.com/microsoft/winget-pkgs/tree/master/manifes...

It's too bad there's still not a great option for "average user that doesn't know/trust how to use a CLI", given how sadly polluted the Microsoft Store can be for many common, especially Open Source, applications. For direct instance, because winget kindly includes Microsoft Store results when searching, there is a "7zip 22" in the Microsoft Store that costs some amount of money (winget details say "PaidUnknownPrice" for the pricing information; I'm on a corporate machine right now with the actual Store access locked so can't search in the actual Store right now) and the Publisher is listed as RepackagerExpress.com. (That website currently doesn't go anywhere, giving it a spot check.)

Having seen this, I may boot up my personal machine and try to report this specific Store listing for violating the Store's Open Source policies, though I'm unsure if such whackamole is all that useful. (Seems like it might be a useful winget feature request for it to provide Store Report URLs.)

For example, see that Firefox has /S here.