Edit: To clarify, my question if this is still Open Source wasn’t meant literal. But more like “is this software still in the spirit of Open Source?” type of question. The better question would be probably, if we should allow this behavior or not.
Also saved it on Internet Archive: https://web.archive.org/web/20260902183330/https://github.com/charmbracelet/vhs/issues/438
So this issue is brought up by me over 2.5 years ago, and nothing changed since then. The issue is now the in top 3 highest upvoted Issue on this repo. At what point is it still open source, if it downloads without your permission a proprietary component that is used to run the software?
It connects to Google server and downloads Google Chrome. One user reported this process cannot be stopped with Ctrl+c (I didn’t try that). It does not ask your permission to do so, and on the README nothing about this was (and still is) disclosed. All I asked is to add an information in the README, so anyone is warned and informed about this before installing. After over 2 years, none of the developers and contributors even acknowledge the issue or any comment whatsoever.
Note: vhs is a terminal application to record input and output of your terminal commands, to replay them later without video recording. Cool project and concept, but this is a no go and to me even malicious.
But that is most likely documented, right? This is not a surprise. Does it download Chrome from the web or is it a dependency on the system and installs it without permission? Does it inform the user doing that? I never installed Invidious myself, so I don’t know the details about this project.
My point is, in example a tool to log your key presses is not automatically a bad tool that steals what you type. If I use a program that’s the entire point of doing my key presses recording and showing me on screen, then I’m not surprised it can do that.