|
Sentharn -> RE: =MECH= Kabikaboo -- The Writer's Assistant Tool (12/27/2009 14:28:02)
|
Xirminator, you are talking to the queen of paranoia regarding data security. (Sorry, bad pun.) I've been using both the Windows and the Linux versions of Kabikaboo for several weeks, and have yet to be befallen by any disasters.
Too long, didn't read: it is safe, but keep backups simply because it is a wise thing to do!
This is the beauty of Open-Source; the code is there for all to see. In the installer, you have the option of installing the original Python code to review (it doesn't do anything unless you have a Python interpreter installed, plus all the fun dependencies like gtksourceview, pygtk, gtk+, etc, etc), which, ironically, is only 80KB. Although many of you are likely not familiar with Python, the source code is written in English-like statements--Python is a beautifully easy-to-read and cross-platform language--and so you can review it yourself in kabikaboo-1.6.src.zip in your install directory. I've looked over the source code myself several times in the past few days; it does what is advertised. In addition, if you are uncomfortable even running the installer, you can download the source .zip directly from here: http://bazaar.launchpad.net/~supertanker/kabikaboo/win32/files (Download kabikaboo-1.6.win32src.zip). If you want to see the "trunk" from which I derived the source code (which, incidentally, the win32.patches in my branch were just applied to), you can either download a Windows Bazaar explorer or download the 1.6 tar.gz release and use a program such as 7-Zip to untar it and examine the original source.
Believe it or not, Xirminator, my first thought after fetching Kabikaboo for the first time was, "This thing isn't going to send my lovingly-crafted storyline off to someone, is it?" During operation, Kabikaboo does not access the network--believe me, that would have red-flagged me immediately. And with three active developers (one of which is me), a small codebase (80KB compressed), and public access to the code repository, it isn't very likely that any malicious code that, say, e-mails all your stories to an oversea e-mail server in China, could last very long. Again, the beauty of Open-Source. This program has been around for at least several months and has been used by dozens of Linux users--it's very unlikely that any such practices would go unreported.
Some of you may be noting the difference in size between the zip source (80KB, which is roughly the size of the Linux download as well--in fact, the Linux download *is* the source!) and the installer (~9mb! What?!). This was a deliberate choice for packaging on my part. I decided against creating a small download package and forcing the user to download the dependencies, lots of stuff that the program depends on. I figured this would make users even more paranoid. I also figured it would turn users off from using this program, because, to be frank, it took four days to set up a working Gtk+PyGTK+GtkSourceView+PyGTKSourceView+Python environment under windows.
So, all these dependencies are packaged as well in the installer, so the end user does not have to go around on a ridiculous scavenger hunt.
Also, some of you may have noticed an .exe executable instead of a .py script in the installation dir. That is because packaging a full Python interpreter with working extensions is next to impossible. Instead, the python scripts have been passed through a Python extension called "Py2EXE", which byte-compiles the .py scripts and "freezes" it and all the extensions it needs into an executable that can execute on any Windows system, instead of only a Windows system with Python+Gtk+PyGTK+GtkSourceview+PyGTKSourceView.
If you're concerned about the more garden variety of malware infecting the file, the installer, executables, and libraries have all been scanned with several utilities (Avast, Spybot Search and Destroy, and Malware Bytes Anti-Malware) and results are negative across three isolated test machines.
In summary: it's safe, but keep backups anyways, since it is a good habit to be in, especially if your data is so important that it raises this concern in the first place. If you want to be doubly-secure, simply ensure that Kabikaboo does not have network access by configuring [insert your firewall here] correctly--indeed, if you are running Windows habitually, it *should* be locked down to a default "deny" rule on all programs, adding exceptions only for those which you are absolutely sure require network access. Kabikaboo should not request network access--I hesitate to say "will not" only because I am not sure if clicking the "Website" link in the "About" dialog counts as network access or not.
Edit: Stupid typo.
|
|
|
|
