No Phone Home!

[oojacoboo]

Guys, we have package managers for checking versions. Is this really necessary? It's certainly not a great look having to dig into a repo to find out if it's doing any funny business.

[codeafridi]

is this real secutrity issue or just network protocols doing its work?

[oojacoboo]

It's not network protocols doing it's work.... whatever that means. It's act sending API requests from your computer to their API server to report the version you're using and any system details. It's not necessary. There isn't any concern at the moment, as it's not sending any other information. But for an open-source lib, it's non-standard and a tad concerning that it was even considered a good idea.

[ChristopherHX]

Act as an "open-source lib" does not do that, this is part of package cmd used by the cli entrypoint. (Yes you called this project a library and not an "open-source executable")

I remember that windows defender flagging an act cli update that started creating an folder just by starting it with --help etc, somehow this defender warning/error in winget disappeared a week later and got released

No I don't control the domain, No I don't have access to any data collected by it, Yes my own version of act cli tool does not call this endpoint anymore

I might be biased due to approving this change years ago (have 100+ PRs merged here), my focus moved to my own version of the act cli tool that is currently at version v0.4.1 (soon v0.5.0) opposed to v0.2.x