Hacker News Reader

Comment by createful | Hacker News Reader

So what's the point of making a GitHub if you're not going to publish source code? Is this an inside joke?

To prevent impersonation and having people download potential malware from repositories posing as the official xscreensaver distribution channel.

I am pretty sure the distro packagers all know where to get the real code from, and its packaged for everything that runs X so minimal risk.

Also assuming something on github is the official repo is dangerous anyway. There might be multiple repos with the same name, there might be a more actively developed fork and the official one might be unmaintained, etc.

It's a dangerous thing which nevertheless happens every day.

So... this doesn't hurt, and can definitely help. It isn't perfect, but it cost JWZ very little to do.

Why are you arguing against it?

Because I do not think making github a way of verifying things is a good idea. It encourages people to assume that whatever they find on github is safe.

The code is not there, but the jwz has a github repo saying it is not there: https://github.com/xscreensaver-official/xscreensaver

As for "happens every day". How often, really? JWZ says "I strongly recommend that you install a binary package rather than compiling it yourself." I would guess very few end users compile xscreensaver themselves.

May be also be relevant to link to JWZ's post about it: https://www.jwz.org/blog/2026/10/gitsquatting/

it looks like the site is offline :(

jwz also famously special cases traffic from hacker news. You may have better luck if you copy & paste the link to avoid sending referrer headers.

You need to open it incognito to avoid the Hacker News insult image!

You cannot hotlink to jwz; he will redirect you to a testicle in an eggcup based on referer header.

Is it known why this is happening?

He doesn't like Hacker News.

Warning: it persists somehow, so you can't click on a link from HN, realise the problem, then copy+paste to correct it. Looks like you need to open an incognito window, use a different browser, or maybe otherwise clear your session.

Just delete the cookies of jwz.org (to be specific, the cookie called HN)

Everytime a jwz link is posted on HN I click on it, and it always works fine. Like just now for the above link.

I mean, you can hotlink to jwz. There are just well-justified consequences if you do so from HN.

My apologies (I actually knew this, and forgot); unfortunately, I cannot edit my post now to advice people to enter the URL manually.

I haven't seen a site that hurts my eyes this much for a very, very long time.

to prevent a malware or something showing up as the top result on Google Search?

Reply on news.ycombinator.com