Are there any Inform7 Security Patches post 2022?

Hi again.

I work in an institution where, because of insurance, Inform7 is considered abandoned due to no updates since 2022.

In know there is currently a lot of work being done by developers and I was hoping, irrationally, I’d missed some release with security patches that exists post that but without any new features.

Forlorn hope probably.

1 Like

No, the last release is from Aug. 2022 (10.1.2). You’ll notice there haven’t been many updates over the years—the last 9.x update was way back in 2015.

2 Likes

Yeah, unfortunately I7 releases are few and far between. But the IDEs are updated more often, so you might have more luck pointing your institution at those?

2 Likes

That sounds promising. Are you able to point me at a repository for such a thing? Is that even the right word? i would appreciate that, a lot.

1 Like

Mac IDE: GitHub - TobyLobster/Inform: Inform is a design system for interactive fiction based on natural language
Windows IDE: GitHub - DavidKinder/Windows-Inform7: Front-end for the Windows version of Inform 7.

Neither has had a recent update either.

2 Likes

Thank you for sending those along Andrew.

Insurance wins :frowning:

I’ll get the kids to use Borogove for now.

1 Like

Given that one of Inform’s big selling points (as advertised in the very first paragraph on the front page of the repository, for example) is that it’s good for use in schools, this might be worth reporting as an issue. If the slow release cadence is keeping it from being used in schools, that’s probably something Graham will want to know about!

Unfortunately, I don’t have permission to access the issue tracker. But there are various people here who do, so hopefully one of them can make a report.

5 Likes

This sounds utterly ridiculous. If it’s a relatively stable piece of software, why should it matter that it hasn’t been updated for 4 years? You shouldn’t expect stable software to be updated very often.

Admittedly, I don’t think Inform 7 is quite as stable as that, but still. The premise just doesn’t make any sense.

5 Likes

Yes. The last stable release of TeX (one of the most widely used typesetting tools in the world) was 2021, version number 3.141592653. This software is considered effectively finished, so any further minor patches are signified by adding an extra digit of π to the version number, asymptotically approaching perfection.

Alas, perfection is apparently insecure.

4 Likes

The only thing more dangerous than an administrator with no IT knowledge is an administrator with an hour of IT knowledge.

Would they consider it ‘un-abandoned’ if someone forked the repository and made a purely cosmetic version number update?

2 Likes

Inform was last updated in October 2025. Yes, that update hasn’t been released yet, and Inform hasn’t had a versioned release since 2022, but it’s certainly not abandoned in any way. I completely understand that your IT staff isn’t interested in building a new version from the bleeding edge source code repository, but since Inform is in active development I’m also pretty sure that if there were any serious security vulnerabilities reported, they would be backported to a new minor release in version 10.

4 Likes

Sadly, I think the real crux of the issue is this (emphasis mine):

It sounds to me as if this decision isn’t being made on the basis of recommendations from the actual IT department, but rather from company policy drafted by insurance actuaries/lawyers.

3 Likes

Yes, that’s understandable enough, but just in case my last comment was unclear:

Inform 7 is not abandoned, so the fact that there haven’t been any security patches post 2022 even though Inform is under active development indicates (to me, at least) that there haven’t been any security issues to patch.

2 Likes

I think this is going down the rathole of an argument with someone not present. Daniel’s software compliance office is not reading this thread. :)

5 Likes

As another data point, I used to teach classes with Inform 7 and ran into this as well, and finally just had to give up introducing Inform 7 into curricula. This was even more the case because the editors (which are not strictly Inform 7) differed, making it difficult to provide consistent directions for students who might use, say, Macs or Windows.

In institutional insurance terms, “abandoned” usually doesn’t mean “no one uses it” or “it’s broken.” It means the software is no longer actively maintained in a way that satisfies the institution’s risk model. “No updates since 2022” is the trigger, not the core concern. Insurance carriers for schools care about exposure: legal, financial, and reputational. Software is one of the easiest vectors for exposure, so insurers push institutions to enforce conservative definitions of “supported.”

The point is that generally when someone says this, they’re not making a technical claim about Inform 7’s quality or usefulness. They’re saying: “Our insurer and compliance framework require evidence of ongoing maintenance. Inform 7 hasn’t shipped updates recently enough to satisfy that requirement, so we’re not allowed to treat it as safe or supported.”

TeX is what you might call intentionally finished software. Donald Knuth didn’t stop because he lost interest or resources; he stopped because the system reached a level of conceptual closure. The whole π versioning scheme is a signal.

The insurance model is almost aggressively ahistorical and anti-philosophical. It doesn’t distinguish between “finished because perfected” and “finished because forgotten.” Instead, it uses proxies. One of the strongest proxies is recent activity. No updates –> no maintenance –> no accountable party –> unbounded risk. The model is crude, but it scales.

TeX survives institutional scrutiny because it has become infrastructural. That ubiquity changes its risk profile. Insurers treat it less like “some software” and more like “part of the environment,” similar to C libraries or PDF readers. If TeX vanished tomorrow, enormous parts of academia would grind to a halt. That alone creates an implicit guarantee of stewardship, even if no one is issuing splashy releases.

To the wider point here, what I learned after a lot of on-the-ground experience is that a relatively precise restatement of many institutions’ position is usually: “We only recognize ‘finished software’ when it has crossed the cultural threshold from tool to infrastructure.” Which is unsatisfying, a little unfair, and very bureaucratic … but internally consistent.

5 Likes

It may be ridiculous for the command-line compiler, but perhaps not so much for the desktop apps:

  • The Windows Inform app contains a browser (CEF) that occasionally renders web pages hosted on the internet (the Public Library of extensions); connecting a four-year-old web browser to the internet probably isn’t security best practice
  • The Linux Inform flatpak is built on an EOL’ed GNOME runtime that no longer receives patches, and it also contains an embedded browser of similar vintage.

Only the macOS app is not really affected by this, since it relies on a system-provided browser component should update itself alongside macOS.

8 Likes

Indeed, a further point is that while the CLI vs IDE distinction is technically real, in an educational context, it doesn’t actually make much difference. Students (generally) don’t experience Inform as “a compiler plus optional front ends”; they experience it as a single tool they install and use. Complicated by the fact that some institutions hear “Inform 7” but then see references to “Inform 10.” (I learned early to just promote the “Inform Development System”!)

From a teaching, support, and risk perspective, the compiler is effectively an implementation detail of the IDE, not a separate deployment path anyone in that context realistically relies on.

On the browsers, it’s a totally valid point. I will say that in most education + insurance contexts I’ve been part of, the insurer almost certainly wouldn’t know that Inform embeds a browser, uses CEF, or ships with an EOL GNOME runtime. That level of detail is usually far beyond what insurers actually inspect. Insurance policies almost never enumerate technical internals. Instead, they impose process requirements on the institution:

  • “All software must be supported and receive updates.”
  • “Unsupported or end-of-life software must not be deployed.”
  • “Applications must meet vendor maintenance criteria.”

Then the institution’s IT or compliance team handles the translation. Someone looks at Inform, sees “last release 2022” (or whatever), can’t find a corporate vendor, and checks the box marked “unsupported.” At that point, the insurer never needs to know. The institution has already classified the risk on its own behalf.

Ultimately, that’s why TeX, Python, and even ancient FORTRAN compilers skate by. Someone, somewhere, is implicitly standing behind them: a foundation, a distro, a standards body, a massive installed base. Inform doesn’t have that kind of visible institutional shield, even if its actual risk surface is much smaller.

A side note is interesting as well, since so many people were hankering for Inform to be open source. In theory, open-sourcing Inform 7 was a positive signal. It means the code is visible, auditable, forkable, and not dependent on a single vendor’s disappearance. From a software-engineering or academic standpoint, that’s resilience. It also aligns very naturally with educational values.

But insurance and compliance frameworks don’t reason about software the way engineers or educators do. They reason about accountability. Open source helps when there is a clearly visible steward: a foundation, a consortium, a named maintainer group with published security policies, release cadences (that part is really important!), CVE handling, and contact points. Again, think of how Linux, Python, or TeX are framed: not just “open source,” but institutionally anchored open source.

And a final note: this only really matters when Inform 7 is institutionally endorsed as part of a curriculum, not because an individual happens to install it on their own machine or use it for a thesis or something. Once a tool is named in a syllabus, a few things snap into place automatically. I’ll spare everyone the details. Suffice it to say that insurers care far more about systematic exposure than one-off risk.

6 Likes

Inform 7 version 10, maybe, to distinguish it from Inform 6, which has a different syntax entirely (and some other stuff is different too).

1 Like

I honestly wish Graham had gone with “Natural Inform”, so that we wouldn’t have to explain that Inform 10 is the latest version of Inform 7, which compiles to Inter, which is the latest version of Inform 6…

Of course, I’m now maintaining the Dialog tools that have five separate version numbers (language/compiler, library, manual, Å-machine, interpreter), none of which are in sync with each other, so what do I know?

4 Likes

Visual Inform .NET

Objective Inform++

Inform 10 Platform, Open Source Edition (I10POSE)

3 Likes