[icegreentea2]

Shipping your own runtimes as part of heavy application isn't that unusual or limited to Python, especially in the Windows world.

For example, JetBrains ships its own Java runtime for all of its IDEs.

In fact, the Python world would be simplified if "ship your own runtime and env" as part of your final application was the norm. The Python runtime and stdlib by itself is like 20-30MB packaged up or something. For certain applications (especially media asset rich ones), that's not that significant.

[formerly_proven]

CPython is ~7-8 MB zipped. Straight from the source: https://www.python.org/ftp/python/3.9.4/python-3.9.4-embed-a...

[icegreentea2]

Omg, thanks!

I don't know how I missed that all this time... I've going off the "zero/dot" releases of https://winpython.github.io/ this whole time.

[foepys]

> For example, JetBrains ships its own Java runtime for all of its IDEs.

That's actually the recommended way for Java applications nowadays. There is no official current JRE for end-users to download anymore - the newest version you can download from Oracle is 8 update 281. JDK is currently at version 16.

[Jonnax]

I'm not familiar with Java programming.

Does this mean that Oracle has decided that Java 8 is the last consumer version of Java?

Or like you've said that applications shouldn't use the OS level java installation?

[somehnguy]

The latter. To ship Java applications it is recommended now that you build a custom bundle instead of relying on the system Java.

[fian]

Post version 8 work was done to modularise core Java. You can now generate a stripped down custom run time to bundle with your application:

https://www.baeldung.com/jlink

[saghm]

Is that just because openjdk is now the canonical (non-enterprise) jdk? Does openjdk not provide an end-user jre anymore?

[foepys]

I don't know the exact thought process that led to this decision but I know that people were incredibly annoyed by the "you need to update Java!" notifications and that applications were rolling their own JRE for quite some time to get around outdated JREs on customer's machines.

[dragonwriter]

> In fact, the Python world would be simplified if "ship your own runtime and env" as part of your final application was the norm.

AFAIK, it is for final applications whose main purpose isn’t to be used as development tools tied to whichever python environment it is installed in.

[Joker_vD]

"Omnia mea mecum porto". If it's a part of you, you can rely on it always be there when you need it.

[PufPufPuf]

Isn't that what PyInstaller already does? It bundles your Python app with a runtime. I've seen a few apps distributed like this, even GUI ones.

[vorticalbox]

Yes, bit for malware you want your dropper to be small and lightweight so it can be downloaded and ran very quickly.

Hence and vb script that downloads python, they could have hosted the rat and downloaded that too rather than writing it line by line.