Page Not Found: v3.14.0.4118 about issues

[lynrayy]

What the fuck why are you deleting this? This thing included in wireguard build and i don't know what to do if your fucking WIX thing (i am really don't know what it is) not exists and page returns me 404

[lynrayy]

Skill issue.

Support issue

[Sainan]

What the fuck why are you deleting this? This thing included in wireguard build and i don't know what to do if your fucking WIX thing (i am really don't know what it is) not exists and page returns me 404

Skill issue.

[lynrayy]

This isn't support for your "wireguard build" or whatever.

This is support for all stuff that using link to old version of this i-don't-want-what-is-thix-(-wix-)

[barnson]

v3.14.0.4118 was a years-old development build with a known vulnerability. So it rolled over and because of the vulnerability, it's not coming back. Update to the fixed build instead.

[Sainan]

Skill issue.

Support issue

This isn't support for your "wireguard build" or whatever.

[Sainan]

This is support for all stuff that using link to old version of this i-don't-want-what-is-thix-(-wix-)

If you don't want it, then I have some good news for you... it's gone now, so you can't even get it!

[tn5421]

Skill issue.

Support issue

I didn't realize you paid for support

[padgriffin]

Keep file undeleted is free

Since keeping a file hosted costs money, it’s actually not free. Keeping it deleted is free though.

[1kaisd1]

Does github have a "block" functionality as Twitte does?

Американская обиженка из твиттера момент. Чуть что не нравится - "РЯЯЯ ЗАБЛОКИРОВАТЬ!!1!"

[alexdcramer]

What the fuck why are you deleting this? This thing included in wireguard build and i don't know what to do if your fucking WIX thing (i am really don't know what it is) not exists and page returns me 404

this is an absolutely horrible way to treat people and you should be ashamed of your actions <3

[wmanning]

It was a development build and was never released.

[wmanning]

It seems irresponsible to hard code a development build URL or even use it. Even for a release build as I see nowhere where the WixToolset project makes a guarantee the URL will remain the same.

Wix v3.11 was the latest of the v3 series until February of this year when they released v3.14 to fix security issues.

[eddyb]

If anyone is curious (like I was), it seems several projects hardcoded that URL in install scripts:
https://github.com/search?q=v3.14.0.4118%2F&type=code

With the most likely relevant one being: https://github.com/WireGuard/wireguard-windows/blob/dcc0eb72a04ba2c0c83d29bd621a7f66acce0a23/installer/build.bat#L24

Without knowing much about WiX's release strategy, at a glance this seems somewhat irresponsible, though I suppose at least they did include a hash (well, wireguard-windows did, some other projects didn't).

---

Anyway, if you're affected, and it's not already obvious from all the other comments:

• file issues on the specific projects hardcoding URLs with the bad version
• if you're running any of that code locally, you can replace the URL up to the last /,
  with https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/
  (if there's a hash you also need to update it, e.g. as done in microsoft/PowerToys@204427d)

[1kaisd1]

I didn't realize you paid for support

1. Keep file undeleted is free
2. I didn't realize what is wix

[marcelloromani]

What the fuck why are you deleting this? This thing included in wireguard build and i don't know what to do if your fucking WIX thing (i am really don't know what it is) not exists and page returns me 404

Does github have a "block" functionality as Twitte does? It would definitely fit this particular abusive use case.

Edit: silly me, it does!
user profile => report => block/report

[robmen]

@wmanning is correct, which makes sense as he's actually someone I'd consider part of the WiX community (i.e. he participates in conversations that are actually about software installation). To the rest of your rabble-rousers (and I say that mostly affectionately 😄), welcome.

Some additional details to back up what @wmanning said. Here is the text that used to be on the WiX Toolset website back in February (removed by this commit:

Development Builds

Development builds have the latest changes, but may introduce unexpected bugs. These are not considered to be production-ready. The latest development build is v3.14.0.6526, published on 26-May-2022.

The message could be a bit stronger and say, "Do NOT use these in your regular CI builds" but it's pretty clear these are dev builds.

Notice that the text is from May 2022. We moved away from this distribution model in WiX v4, so this is "the old way" of doing things. However, we try very hard in the WiX Toolset to maintain backward compatibility within major versions, so nothing was touched. But we make exceptions to that rule when it comes to security fixes.

Want to guess when we had a WiX v3 security fix? Yep, February 6th, 2024. That is when all the insecure versions of the WiX Toolset were marked insecure, and old (non-production ready) development builds were simply made no longer accessible.

By the way, this is exactly what @barnson (co-maintainer here) said in his first comment:

v3.14.0.4118 was a years-old development build with a known vulnerability. So it rolled over and because of the vulnerability, it's not coming back. Update to the fixed build instead.

If you actually use the WiX Toolset, you should follow the FireGiant blog because this issue was triaged and is part of the meeting notes. The video is there if you want to hear us discuss this issue.

Anyway, this has been grand fun. I hope you now realize that we take our work on the WiX Toolset seriously, and while we do occasionally make mistakes, we have a goal and purpose to the work.

As much fun as it is to see all of your rabble-rousing comments (and I do feel the love and appreciate the support in solidarity ❤️), I'm going to lock this thread now since I don't think there is much more constructive to add to it.

And keep supporting your maintainers you rabble-rousers !!! But do try to be mostly kind and remember what Yoda said.