WARNING: this post has been written in April of 2024.
I put this post here because I had deleted it from fedi before thinking it'd be better to have it available somewhere.
Most of the points I made here are valid, but I've realized that as a whole this is bullshit. In retrospect, my tone was unnecessarily heated and I did kinda miss the point.
I ain't proud of this one but I do want to keep it accesible for posterity. My opinion has since changed; see my blog post about this. cya
For those that go crying on social media about an application telling you to curl | bash or even to curl | sudo bash because you're running arbitrary code as root:
That is useless unless you plan to carefully review and audit every line of code that runs on your computer.
Even if you do install said app, do you actually trust it's code? Do you trust it's dependencies? What about it's subdependencies?
There's an infinity of ways to infect an open-source repo with bad code, and some of them are actually scarily easy to perform. Do you trust that your favorite compression utility doesn't contain code that backdoors freaking ssh (https://nvd.nist.gov/vuln/detail/CVE-2024-3094)? Do you trust that a script won't remove a critical system directory because of a misplaced space (https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issues/123)? Or that an ubiquitous logging library can allow remote code execution because of a bad default configuration (https://en.m.wikipedia.org/wiki/Log4Shell)?
I hope I can get this message stuck deep inside your head and let you know that unless you make your own operating system from scratch (including your free bootloader, kernel, gpu driver and the rest), you have to trust somebody. And it only takes one mistake to compromise a whole distribution, or even worse. You have to balance between having a new shiny program and having a new way to get shelled.
memetic apiopage | buttons credits | warrant canary
copyright notice: This webite's source code and built webpages when shared in their entirety are provided under the GPL-3.0 license. All blog posts, articles and Markdown files contained within the git repository are shared under the CC BY-NC-SA 4.0 license. If you want to use my content for commercial purposes, feel free to contact me.
This is an actual website. Read the web0 manifesto.
This page is cleaner than 0% of all web pages globally according to websitecarbon.com.
Built by mkdocs and served by tilde.club.
rss feed: todo - email me if you want to subscribe !
Last update: 2024-08-24