149

PySimpleGUI is now closed-source (github.com)

submitted 10 months ago* (last edited 10 months ago) by ebits21@lemmy.ca to c/python@programming.dev

78 comments fedilink hide all child comments

Previously LGPL, now re-licensed as closed-source/commercial. Previous code taken down.

Commercial users pay $99/year, free for personal use but each user has to make a free account after a trial period.

you are viewing a single comment's thread
view the rest of the comments

[-] XTL@sopuli.xyz 11 points 10 months ago

Does pip really allow binary blobs? That effectively makes it zero security.

[-] etrotta@programming.dev 7 points 10 months ago

To be fair it has some valid use cases, take ruff for example.

But pip/pypi does not have any proper security at all, and just blocking binary blobs wouldn't make a difference when you can freely execute any python code during installation - Much like downloading an executable from any site online, you are expected to make sure you can trust whoever uploaded what you are downloading. You could say the same about other sites like GitHub too.

[-] XTL@sopuli.xyz 6 points 10 months ago

There is a fair difference still between source available and binary blob. The blob has essentially no chance of ever being audited.

[-] elguaxo@lemmy.dbzer0.com 4 points 10 months ago

Take a look at the Source Distribution files: https://pypi.org/project/PySimpleGUI/#files

As far as I can see, it's still all just Python.

[-] MinekPo1@lemmygrad.ml 2 points 10 months ago

binary blobs aren't really a security hole , since AFAIK the pypi team don't check every package for malicious code before they get shown publicly . it just shifts the trust from pypi to the library authors