Alt account of @Badabinski

Just a sweaty nerd interested in software, home automation, emotional issues, and polite discourse about all of the above.

  • 0 Posts
  • 7 Comments
Joined 7 months ago
cake
Cake day: June 9th, 2024

help-circle


  • it’s trivial to break that approach by obfuscating strings. You can do things like using base64 encoded strings in the source code, building strings from smaller component parts, or using rot13 on, say, the host component of a URI. That last one could be pretty interesting if you, as a threat actor, owned both permutations. The hostname (minus TLD) in the source code could be the nice, human readable version (www.happysite.org) that appears to be something legit. Then, when you rot13 it to www.uncclfvgr.org, traffic is sent to the evil site doing scary things. People can be far more tricksy than that. There’s also the whole issue around whether or not the binaries you’re running actually match the code in the repo. The xz kerfuffle showed how much can be hidden that way.

    EDIT: I should make it clear that I don’t use Deepin or the DE it provides because I only use WMs with no desktop, so the distro and DE are of no interest to me. I don’t know if it’s a security hazard or not, I have no horse in this fight.



  • For me, it’s Arch for desktop usage. When I first started using Arch it would not have been Arch, but now it’s Arch. The package manager has great ergonomics (not great discoverability, but great ergonomics), it’s always up to date, I can get a system from USB to sway in ~20 minutes (probably be faster if I used the installer), it’s fast because it doesn’t enable many things by default, and it’s honestly been the most reliable distro I’ve ever used. I used to use OpenSUSE ~10 years ago, and that broke more in one year than Arch has in ten.

    I personally feel like Arch’s unreliable nature has been overstated. Arch will give you the rope to hang yourself if you ask for it, but if you just read the emails (or use a helper that displays breaking changes when updating like paru) and merge your pacnews then you’ll likely have a rock solid system.

    Again, this is all just my opinion. It’s easy for me to overlook or forget all of the pain and suffering I likely went through when learning how to Arch. I won’t recommend it to you, but I’ll happily say how much I’ve come to enjoy using it.


  • What if you need to file a bug? What if you have a question on the config that’s not easily answered by the docs? If you never, ever find bugs and never, ever have questions, then sure, separate the two. There are genuinely people like that, but they’re not common. If you’re one of them, then I’m genuinely glad for you.

    My opinion is this: You use software. You don’t use people, but you sure as hell rely on them.