Hacker, writer, translator, unix & programming nerd.

  • 0 Posts
  • 22 Comments
Joined 9 months ago
cake
Cake day: August 6th, 2024

help-circle
  • Not so much what’s preventing, but how hard it is to get away with it.

    Whatever closed-source software is doing on your system, there is no way to know to begin with, what it is that it is doing. You can only look at the outer effects it has, but you can’t examine it much. So even if a closed system is doing all sorts of things, as long as it’s stealthy enough, there would be no consequences at all.

    This is the very opposite is what you get with FOSS, not to mention the difference on how software is developed, built, distributed and managed in unix systems compared to proprietary ones.




  • While another comment covered the matter of security updates, another point that is safer about repositories is the security of the binary and the transaction. Meaning, the place you get your software from and how this transference is accomplished are also security sensitive.

    When you get the software from a repository, you typically have some assurance that (a) the binary you are getting was compiled from the source that is published (b) the source from which you are downloading is known and trusted © the method through which you are transferring is somewhat secure (e.g. TLS) (d) the changes made were inspected by at least one more independent party (depends on the repository’s policies).

    Repositories will also have criteria for inclusion, which can bar you from software you want, but still could also mean software with bad security practices never reached you to begin with. Being included in the repository might also mean it’s up to more scrutiny, as it may be removed depending on what security events happen in the future.

    Say that instead we were to get the software directly from the original source. How will this source transfer the software to you? If they publish it on a website, that adds one more attack surface where, if an attacker tampers with files, hashes and/or links, you are now no longer getting it from the source. Say instead you get it from a Git forge such as e.g. GitHub. Is the binary being built form source in CI? Or is it uploaded manually? Does it provide a hash? How can we know the manually uploaded binary, even if it has a hash, was compiled from the publicly available source? There is no trusted, independent third party involved to confirm that.

    I can think of a few other reasons unrelated to security, such as repositories, particularly distro/OS-specific repositories but not only them, will tailor the software to your OS, resolve dependencies for you and add niceties such as init system integration, shell completions, man pages and sample configuration that is specific to your OS.


  • If you see yourself facing this often, you can also use a browser extension to make it easier to see the post you are at in your instance.

    For Firefox and derivatives, the simplest one is Lemmy Link, which places a Lemmy icon next to links such as the sibebar’s !community link in the instructions for logged out users to find the community in their own instance. It has not been updated in two years, but still works.

    Another option is Kbin Link, which does the same thing and has seen recent updates but tends to trigger “this extension is slowing down…” notifications.

    A third one I found is Instance Assistant, which instead adds a “Find in my home instance” button to the sidebar. It does have some additional features, but I couldn’t get them to work. This one is also available for Chromium-based browsers.








  • I think you really miss the point. It’s as if your suggestion that romanization methods have imperfections dismisses the actual reasons why people will refuse to make the effort to learn how to pronounce a name from a language other than their own, which go far beyond whether or not the spelling “makes sense”.

    The comic gives a very concrete example of that. It wouldn’t matter if the letters exactly mapped to a perfect pronunciation, the mere fact it does not roll of the tongue, i.e. “sounds foreign”, coupled with the underlying xenophobia+racism combo is what’s at work there.