49
charmbracelet/vhs a cli tool installs Chrome in the background without permission - is this still Open Source? (github.com)
submitted 1 week ago* (last edited 1 week ago) by thingsiplay@lemmy.ml to c/opensource@lemmy.ml
13 comments fedilink hide all child comments

Edit: To clarify, my question if this is still Open Source wasn't meant literal. But more like "is this software still in the spirit of Open Source?" type of question. The better question would be probably, if we should allow this behavior or not.

Also saved it on Internet Archive: https://web.archive.org/web/20260902183330/https://github.com/charmbracelet/vhs/issues/438

So this issue is brought up by me over 2.5 years ago, and nothing changed since then. The issue is now the in top 3 highest upvoted Issue on this repo. At what point is it still open source, if it downloads without your permission a proprietary component that is used to run the software?

It connects to Google server and downloads Google Chrome. One user reported this process cannot be stopped with Ctrl+c (I didn't try that). It does not ask your permission to do so, and on the README nothing about this was (and still is) disclosed. All I asked is to add an information in the README, so anyone is warned and informed about this before installing. After over 2 years, none of the developers and contributors even acknowledge the issue or any comment whatsoever.

Note: vhs is a terminal application to record input and output of your terminal commands, to replay them later without video recording. Cool project and concept, but this is a no go and to me even malicious.

top 13 comments
sorted by: hot top new old
[-] thingsiplay@lemmy.ml 16 points 1 week ago* (last edited 1 week ago)

https://github.com/asciinema/asciinema is an alternative almost as much popular as vhs. I used it in the past after removing vhs, but its years ago and don't know how they actually compare. Someone recommended this in the comments few weeks ago, I had completely forgotten about it. I recommend asciinema instead vhs, if you want record and playback terminal sessions without videos involved. I think you can even edit and make changes to the recording, as it is just a text file: https://docs.asciinema.org/manual/asciicast/v3/ (its based on a newline delimited JSON format)

[-] eleijeep@piefed.social 3 points 1 week ago

I was going to suggest this one. I haven't used it but I listened to an interview with the developer of asciinema on one of my favourite podcasts: Developer Voices. That's as good as a recommendation to me.

The interview is here on youtube: https://www.youtube.com/watch?v=sHwWNFAjAxo

[-] Shimitar@downonthestreet.eu 10 points 1 week ago

Technically it is open source if .. the source is open source. Then, if it uses proprietary components under the hood as binaries, well... In that case any windows tool that uses Msvc redistributable would not be able to be open source.....

[-] thingsiplay@lemmy.ml 6 points 1 week ago

Agreed. I understand that, but my question wasn't meant to be a technical one. It was more like "is this still spirit of Open Source, if the core application is not part of the source, and it does all of that without permission". At least those Windows tools you mention, are using part of the operating system without doing something without permission (hopefully).

[-] hoshikarakitaridia@lemmy.world 8 points 1 week ago

Not to be an asshole but maybe this is the wrong question then.

Maybe the real question is "should we endorse this in the FOSS community" or "how do we handle things like this".

Which absolutely is a fair question.

[-] thingsiplay@lemmy.ml 2 points 1 week ago

I don't think there are wrong questions, if they meant to be curious and no trolling. But besides that, my refined question (you reply to) is actually what you suggest. Because to me, this is not really in the spirit of Open Source. But, if you don't like this question in the form I asked, I mean your suggestion is pretty much what I question myself (and its more direct).

[-] eldavi@lemmy.ml 4 points 1 week ago

it feels like an older iteration of free software -- shareware, freeware, warez, etc. -- where it's free to use, but still does proprietary shit under the hood.

in some respects, this type of software predates open sources, so it's always been around and now this makes it look like it's started wearing the open source vibe as a skin.

[-] Shimitar@downonthestreet.eu 3 points 1 week ago

Yeah.. It should pull at very least chromium I guess....

[-] beyond@linkage.ds8.zone 9 points 1 week ago

A program is free software if it gives its users the four freedoms: the freedom to use, share, modify, and share modified copies. However if it depends on a proprietary library, application, or SaaSS to do its function then I don't think it meaningfully counts as free software, because it's unusable without that proprietary component.

I don't understand exactly why this tool requires a web browser, much less Google Chrome specifically. Surely it could use a browser that exists on the system, or if it needs Chromium specifically it could specify that as a dependency and let the user or the system fulfill that. If it's downloading and executing some binary from a remote server without informed consent I would consider that malware regardless of whether this app or the app it's downloading are free or not.

[-] Celediel@slrpnk.net 6 points 1 week ago

The charm team are heavily invested in LLMs and AI. I wouldn't expect them to take license agreements seriously.

[-] Sxan@piefed.zip 3 points 1 week ago

I switched to s-vhs because of þis issue. Same file format, same functionality, no Chrome.

Why does a program to record terminal interactions require a web browser? It's sketchy as hell.

[-] thingsiplay@lemmy.ml 1 points 1 week ago* (last edited 1 week ago)

Nice. Looks like a good alternative. Its first release is only a month old (or new). I first thought this is a fork, but looks like a new project. And its completely written in Bash instead Go. Its a wrapper script around asciinema and tmux. It is quiet new and it uses constructs such as rm -f -- "$_SVHS_TEMP_CAST" without extensive checking if this is okay to do so, which I am not a fan of. But I don't see anything else worrying about.

I'm probably just cautious because I got burned a lot... alive.

[-] Sxan@piefed.zip 2 points 5 days ago

Ouch! It sounds like you have a story. I've been mostly fortunate: þe worst damage I've sustained has been self-inflicted. Unless you count ext* bugs.

this post was submitted on 02 Sep 2026
49 points (98.0% liked)

Open Source

48947 readers
359 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 7 years ago
MODERATORS
Cloak@lemmy.ml
kevincox@lemmy.ml
CrypticCoffee@lemmy.ml
Lettuceeatlettuce@lemmy.ml