topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • November 18, 2019, 11:15 AM
  • Proudly celebrating 13 years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Last post Author Topic: Release: sWeather (tray-based weather app)  (Read 260151 times)

skwire

  • Global Moderator
  • Joined in 2005
  • *****
  • Posts: 5,167
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #700 on: March 03, 2019, 09:57 PM »
Thanks so much for your response - maybe had I read more of the Forum, I could have saved both of us some time!  Thanks again for sWeather.

You're very welcome and no worries.  I'm glad you find sWeather useful.

mhh

  • Participant
  • Joined in 2019
  • *
  • default avatar
  • Posts: 2
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #701 on: March 05, 2019, 03:56 AM »
Thank you for the report.  It should be fixed in the latest version below:

Website & Download
v1.8.2 - 2019-03-01
    ! "Feels like" temps of zero degrees would display as N/A.  (Thanks, mhh)


Thank you for the quick improvement. I can confirm that it works correct now.

WPYS

  • Participant
  • Joined in 2019
  • *
  • default avatar
  • Posts: 1
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #702 on: March 05, 2019, 07:24 AM »
Hey guy,
    I found that the latest version 1.8.2 could not show selected city's name when I hovered my mouse on any of the tray icons. I am very sure that
 previous version (for example version 1.7.x)  can show different information when hovering on tray icon including selected city's name. Please bring it back!
111.jpgRelease: sWeather (tray-based weather app)
222.jpgRelease: sWeather (tray-based weather app)

skwire

  • Global Moderator
  • Joined in 2005
  • *****
  • Posts: 5,167
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #703 on: March 05, 2019, 10:32 AM »
Hi, WPYS, and welcome to the DonationCoder site.

I found that the latest version 1.8.2 could not show selected city's name when I hovered my mouse on any of the tray icons. I am very sure that previous version (for example version 1.7.x)  can show different information when hovering on tray icon including selected city's name. Please bring it back!

https://www.donation....msg428166#msg428166

Drugwash

  • Participant
  • Joined in 2009
  • *
  • Posts: 54
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #704 on: March 10, 2019, 09:56 AM »
I took the liberty to modify the script a little in regard to tray icon display and a (fake) tray tooltip.
It is an older build based on v1.7.9.1 and is only a proof of concept. It does feature a few code fixes aimed at x64 compatibility but there's still a lot of work to be done to achieve that goal. There are also a few bugs related to the fake tooltip positioning and timing, at startup and while changing options.
« Last Edit: March 10, 2019, 04:15 PM by Drugwash, Reason: Removed attachment »

skwire

  • Global Moderator
  • Joined in 2005
  • *****
  • Posts: 5,167
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #705 on: March 10, 2019, 02:13 PM »
I took the liberty to modify the script a little in regard to tray icon display and a (fake) tray tooltip.
[...]
Attached is a zip archive containing only the source code - no executable. Code has been tested using AutoHotkey v1.1.28.0 Unicode.

While I appreciate your interest in improving sWeather,  I do not appreciate you decompiling the code, making changes, and then posting it publicly.  My programs are not open source. Please respect that, and stop.
« Last Edit: March 10, 2019, 02:54 PM by skwire »

Drugwash

  • Participant
  • Joined in 2009
  • *
  • Posts: 54
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #706 on: March 10, 2019, 04:22 PM »
Yeah, I know: no good deed remains unpunished. I removed the attachment. Nobody dowloaded it anyway.

wraith808

  • Supporting Member
  • Joined in 2006
  • **
  • default avatar
  • Posts: 10,286
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #707 on: March 10, 2019, 07:10 PM »
Yeah, I know: no good deed remains unpunished. I removed the attachment. Nobody dowloaded it anyway.

Decompiling someone's source and reposting it doesn't seem to fall under the definition of good deed to me.

mouser

  • First Author
  • Administrator
  • Joined in 2005
  • *****
  • Posts: 39,527
    • View Profile
    • Mouser's Software Zone on DonationCoder.com
    • Read more about this member.
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #708 on: March 10, 2019, 11:19 PM »
I think the place to start from -- the first thing that needs to be said -- is that drugwash was trying to help and improve the program.  And that furthermore, he was making the non-trivial effort share his improvements in a respectful way with the author (our wonderful skwire) and the rest of us.

So in my humble opinion, the first thing that needs to be said to drugwash is "thank you".

After that, it's skwire's right to ask that drugwash not share/post modified versions of his software.  I can understand why that would be disappointing to drugwash, who was just trying to contribute some improvements to a program he obviously likes.

Most of the people on this site are fans of open source software -- coding and using it.  Many of the coders here release some, if not all, of their source code as open source and participate in open source software.  People who are sharing their programming skills here on this site are doing so largely because of the enjoyment we get in having others use our software.  But many of us here also have some software which we have, for various reasons, decided not to open source. For whatever reason, it is ultimately the coder's prerogative. 

Anyway, this is just my long way of saying to drugwash that I (we) appreciate the good deed you were trying to do, and don't want you to walk away with bad feelings about this -- rather I hope you will stick around and continue to participate, offer improvements of other sorts, and feel welcome here.  We are nothing if not a home for unusual people with unusual skills :up: :-*



leftdisconnected

  • Supporting Member
  • Joined in 2019
  • **
  • default avatar
  • Posts: 2
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #709 on: September 08, 2019, 12:40 AM »
Unfortunately, my recent download of the March v1.8.2 sWeather release is being detected as malicious by at least 8 engines in VirusTotal.  The scan for the ZIP release can be seen HERE.

The bare executable triggers 12 detections, which can be seen HERE.

It's normal for less popular files and applications to trigger a few engines at VirusTotal, but 8 or more detections is rather uncommon.  I've been aware of sWeather for a number of years and am sure that skwire is a trustworthy developer, but is it possible that this file has been tampered with or are these all just false positives?  Even Microsoft is flagging this as PUA:Win32/Presenoker.

Deozaan

  • Charter Member
  • Joined in 2006
  • ***
  • Points: 1
  • Posts: 8,853
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #710 on: September 08, 2019, 01:03 AM »
Jotti shows only a single false-positive for v1.8.2:

https://virusscan.jo...lescanjob/2ouelcotx0

skwire

  • Global Moderator
  • Joined in 2005
  • *****
  • Posts: 5,167
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #711 on: September 08, 2019, 11:21 AM »
I've been aware of sWeather for a number of years and am sure that skwire is a trustworthy developer, but is it possible that this file has been tampered with or are these all just false positives?
-leftdisconnected (September 08, 2019, 12:40 AM)

I just downloaded it and checked its SHA-256 hash against my local copy.  If you're downloading it from my DonationCoder site, it has not been tampered with.

SHA-256 hash: 33A19E4117DE230A0E9CBCF692BEEB4FEDC4075C8CA3001E91BB8C1AF1334779

Thank you for taking the time to write.  These are false positives that come and are due to the language my applications are written in (AutoHotkey/AHK).  In the past, as a test, I've  written a single line AHK script and compiled it:

Code: Autohotkey [Select]
  1. F1:: ExitApp

That's it...one hotkey to exit the script.  Even that wouldn't come up clean on VirusTotal.  I know it's only my word, but I can state that there is no malware in any of my
 applications that are downloaded directly from my site.  That said, I cannot vouch for the various software repository sites that list my software as some of them wrap my software into their adware-bundled installers.  This perturbs me, but there is little I can do about it.  For the record, I do not submit my software directly to any of these types of sites; they pick my programs up automatically.

Years ago, when the AV companies were a lot fewer, I used to contact them about stuff like this.  Things would get fixed but, due to the AV updates, false positives would, inevitably, occur again. I got tired of dealing with it, so now I just shrug and trust that my body of work speaks for itself.  I know it sounds terribly apathetic, but fighting it just isn't worth the cycles anymore.  Cheers.





leftdisconnected

  • Supporting Member
  • Joined in 2019
  • **
  • default avatar
  • Posts: 2
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #712 on: September 08, 2019, 02:40 PM »
I just downloaded it and checked its SHA-256 hash against my local copy.  If you're downloading it from my DonationCoder site, it has not been tampered with.

SHA-256 hash: 33A19E4117DE230A0E9CBCF692BEEB4FEDC4075C8CA3001E91BB8C1AF1334779

Thank you for taking the time to write.  These are false positives that come and are due to the language my applications are written in (AutoHotkey/AHK).

Thanks for the awesome response and verification.  Your response and hash check serve as a record for future concerns, at least with this release.  My hash indeed matches the one you've provided.  It might be useful to list this hash in the download area on your official website, but this can convey false verification if a website is hacked (hackers may change the displayed hash to match their infected package). 

I've also written AHK scripts and am aware that A/V tends to be scared of it, but was concerned for the following reasons:

1.  8+ engines still triggering more than 6 months after the release, including Microsoft's (though local Defender does NOT trigger).
2.  No other posts asking about false positives with this release (there are usually lots).

I've been involved with a few projects and authors generally find that detectors "calm down" after seeing the same executable for weeks or months with no related impact (via whatever metrics are used).  We also tend to have tons of questions about false positives, which inevitably surge with each new release, even for signed code (which rather undermines much of what I'm about to say ;) ).

Years ago, when the AV companies were a lot fewer, I used to contact them about stuff like this.  Things would get fixed but, due to the AV updates, false positives would, inevitably, occur again. I got tired of dealing with it, so now I just shrug and trust that my body of work speaks for itself.  I know it sounds terribly apathetic, but fighting it just isn't worth the cycles anymore.  Cheers.

That's entirely understandable :up:.  There are so many AV brands and engines that correcting false positives is an impossible task.  Almost no one bothers with this anymore unless they're Mozilla or someone like that and in that case they're hopefully squashing those issues before mainstream release.  However, I posted due to the combination of both a relatively mature release and no other false positive posts associated it.  Thanks for clearing this up.

There are limits to what you are willing and able to do as an independent developer, but signing your code with your own certificate would be a possibility.  If you keep the same signing cert over many years, it builds up a reputation to match your own.  In other words, if you've signed it with a cert that has been established to be yours, then interested users can extend your reputation to your cert.

I've seen other projects that create a new signing cert for every major code release and that's just a waste of time and effort.  With code signing, we want as long a certificate lifetime as possible to build its reputation.  Sure, we can sign our new certs with our old one to create a chain of trust, but there's no reason that a modern signing certificate shouldn't be trustworthy for at least 5 years.  Just MHO.

I'm not suggesting that you must sign your code as it's an extra hassle and 99% of users will never bother to check it anyway.  Still, I'm a terribly unskilled programmer that mostly just creates bad scripts that nobody else needs, yet I sign anything I release.  Even if only 1 user actually verifies it, that's a chance for someone to find out that my website/repository has been hacked, etc.  After initial setup, each signature takes seconds to do.

I sound like a salesman here, but I'm not trying to convince you to do this.  I'm just rambling about it for anyone who might be interested.  OpenPGP is not a perfect system and I understand if developers don't believe that it's worth the effort.  For example, most of the time I must download the signing cert from the very same website that I downloaded both the package and the signature from, which basically brings us back to the vulnerability of simply listing the hash; that's why long-term signing certs are so valuable.

Thank you so much for your time and attention and for creating and maintaining such useful software.

On a side note, I find it interesting that I can report my own post as SPAM  :P .                                vvvvvv
« Last Edit: September 08, 2019, 06:18 PM by leftdisconnected »

mouser

  • First Author
  • Administrator
  • Joined in 2005
  • *****
  • Posts: 39,527
    • View Profile
    • Mouser's Software Zone on DonationCoder.com
    • Read more about this member.
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #713 on: September 09, 2019, 11:44 AM »
Welcome to the site, leftdisconnected  :Thmbsup:

Your suggestions and reasoning are very reasonable.  :up:

For installers, I highly encourage signing with a digital certificate; and with executables it makes a difference in how Windows displays them, and can definitely make people feel safer using them.

Your point about "It might be useful to list this hash in the download area on your official website, but this can convey false verification if a website is hacked (hackers may change the displayed hash to match their infected package)." is valid; for small scale websites that's pretty darn unlikely though.  And one good alternative solution would be to post a hash value on a different server (like this forum), from the one hosting the file.  Whether it's worth the hassle is another matter.. It does at least increase the likelyhood that someone would discover a tampered file sooner rather than later, which is always good.

Brothbeard

  • Supporting Member
  • Joined in 2014
  • **
  • Posts: 12
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #714 on: September 17, 2019, 06:28 AM »
I've noticed recently that the temperature reported via the Yahoo API is running up to two hours behind, which renders the app a bit pointless. E.g. it is presently 12:26 BST and the last provider update was 11:00 BST. Sweather is reporting 15C and other apps are reporting 17C. Refreshing doesn't help. Any ideas anyone?

skwire

  • Global Moderator
  • Joined in 2005
  • *****
  • Posts: 5,167
    • View Profile
    • Donate to Member
Re: Release: sWeather (tray-based weather app)
« Reply #715 on: September 17, 2019, 11:07 AM »
sWeather uses the Yahoo! Weather API so, unfortunately, it's at the mercy of the data it receives.  In other words, there isn't anything I can do about it programatically.  I suppose you could write an email to Yahoo!, but I'm going to assume it will fall on deaf ears.