• 0 Posts
  • 20 Comments
Joined 1 year ago
cake
Cake day: June 4th, 2023

help-circle









  • I recommend the Thinkpad yoga 11e, which is their education edition. They’re out of stock at the moment, but they’ll come back soon. They always do. It’s an 11 inch laptop with a flip around touch screen and integrated stylus. Works perfectly with Linux. It’s not super fast, but it’s under 300 dollars new. And it’s made for kids so it’s durable. I have one and I love it. You can get one used if you like, but at that point you’re probably better off with an older model.





  • There’s a nuclear test site in Georgia where the us government did preliminary tests for a nuclear powered airplane. It was bat shit insane. It seems the idea was not to shield the reactor, but to only shield the crew, and rely on distance and speed to not irradiate basically everything else.

    To that end, they built a nuclear reactor that could be hoisted in and out of a hole in the ground so that it could be run unshielded above ground. They tested the effects on all sorts of materials, and a huge swath of surrounding woods, including all the creatures there, which promptly died.

    It’s now a recreational area, and considered generally safe, except for a few small, fenced off areas.

    So my point is, watch what you wish for.



  • I think people can hide lots of things in code, especially when people don’t generally look at it. And I know people don’t look at it when they talk about how convenient the aur is. It’s at best marginally more convenient than installing from source.

    I’m not at all suggesting that people should place more trust in large companies. I’m suggesting that packages in the aur with lots and lots of users should be trusted more, specifically because some of them will be checking out the pkgbuild, and the source, and presumably some of them would notice if the software did something it wasn’t supposed to do. Obviously the larger the software the harder that all is to check, and correspondingly you’d want to see many more users using it before you’d extend it any trust.

    My point being, i’ve not seen these discussions taking place. Maybe I’ve just missed them. But I feel like it’s appropriate to bring it up when I see people talking about just how.convenient the aur is. It’s really not that convenient if you’re using it in a way that i’d consider reasonable.


  • Yes. It is possible to verify what’s going on. That’s what I did when I used the aur. Do you think most people do that, or even look at see how many users are using the software? Or do you imagine they just install it blindly?

    If you ever see a help video or article that suggests installing something from source, or run some script people generally tell the reader that they shouldn’t just run random code without looking at it. I’ve never once seen anything that suggested people should check the pkgbuild. I don’t have a problem with the aur. I just think it’s not nearly as trustworthy as it’s generally made out to be, and I don’t think people generally understand that it might even be a concern, or that you can check the validity of the package yourself.


  • Right, and that’s a good reason why you should feel reasonably comfortable installing very popular software from the aur, once it’s been there for a while. That’s not why people like the aur.

    People like that you can get even unpopular stuff in the aur, and that’s the stuff you need to be suspicious of. If you’re getting some niche y2k era packet radio software from the aur, you should be checking how it’s packaged and what is actually being packaged. And if you have the knowledge to do that you might as well get the source and install it yourself. I’ll admit that i’m getting old, and I don’t know if that’s something people aren’t willing or able to do these days.

    Maybe i’m just cranky about arch, but it just seems really stupid to me to go through manually installing and setting up your system just to either install some random crap from the aur, or have to manually review it all because the official repos are pretty bare.


  • Ordinarily I use apt. Sometimes a flatpak if I trust the source. Otherwise it’s from source or usually something i’m running in docker, where I’ll check what it’s actually doing if i’m at all suspicious.

    I don’t want to make too big a deal of the aur. When I was using arch and I needed something from the aur it was easy enough to see that it was a legitimately packaged piece of software. The only big deal is that it’s a real pain in the ass, and I know most people aren’t doing that, and I never see anyone mention it so I doubt people even consider that it could be an issue.

    It comes down to what you trust. I trust the stuff I can get from Debian’s repos. I trust some other sources, and everything else I look at. I don’t trust the aur, and I sincerely doubt most people look at the software they’re installing from it to make sure it’s legit.

    It’s really none of my business what others are comfortable with. The trustworthiness of where you get your software is a decision you have to make for yourself, and with the way people go on about the aur I get the feeling they don’t bother to decide. I don’t ever hear anyone acknowledge that there’s any sort of difference between the aur and Debian’s repos, but that’s just frankly an utterly absurd idea.


  • Do you look at the stuff in the aur? Because any of that stuff you install from there could be messed with because it’s a user repository. I specifically left arch because I had to look into all the packages I installed from the aur, and the stuff from the official repos was pretty limited compared to something like Debian. That took a lot of time. Or, you could always just install whatever you find with zero concern about security.

    I’ve been running Debian for decades with maybe 2 problems I had to manually resolve with apt. I ran arch and manjaro for maybe a year, and had a handful. I’m certainly not going to say not to run arch, but it’s in no way easier to keep running than Debian. That’s literally Debian’s whole gig.