News for hackers. Stuff that matters.

A comment on Is there any future for the GTK-based Desktop Environments?. Parent comment

Re:Is there any future for the GTK-based Desktop Environments? by sph on Friday April 08, 2022 @07:02AM (#30955497)
Because there is a push for software developers to be able to package directly for end users. Without devolving into the usual flame war of whether it's a good idea or not, once you install any piece of software you incur some security risks. It's not like distro maintainers are a 100% guarantee there won't be a backdoor in the binary, and compiling software from source doesn't free you from risks either, unless you code-review everything you install.

My point is, containerisation on Linux isn't necessarily slow—in fact it's unnoticeable if implemented correctly—and I prefer to default to having a decent amount of security by containerising as much software as I can, whatever the origin. Including, and especially software like the calculator, since it should not be able to do anything more than show a GUI and add numbers together.

[ Parent | on HN ]
Re:Is there any future for the GTK-based Desktop Environments? by nix23 on Friday April 08, 2022 @08:20AM (#30955988)
That's not what i asked, why do you trust a no name dev more then the distro your kernel is coming from? And do you really think flatpack prevents you from running packed malware?
[ Parent | on HN ]
Re:Is there any future for the GTK-based Desktop Environments? by wander_homer on Friday April 08, 2022 @10:39AM (#30957420)
Why do you assume the flatpak comes from a no name dev? My calculator flatpak comes from the same people who wrote it, and I obviously trust them, otherwise I wouldn't be using their application.

So why should I trust them less than my distribution?

[ Parent | on HN ]
Re:Is there any future for the GTK-based Desktop Environments? by nix23 on Friday April 08, 2022 @12:15PM (#30959035)
Ever used npm?
[ Parent | on HN ]
Re:Is there any future for the GTK-based Desktop Environments? by wander_homer on Friday April 08, 2022 @12:44PM (#30959421)
No, and how is that even relevant?
[ Parent | on HN ]
Re:Is there any future for the GTK-based Desktop Environments? by nix23 on Saturday April 09, 2022 @04:21AM (#30966174)
>So why should I trust them less than my distribution?

Just use google -> npm malware

[ Parent | on HN ]
Re:Is there any future for the GTK-based Desktop Environments? by wander_homer on Saturday April 09, 2022 @04:24PM (#30971679)
I said I'm not using npm.

With my calculator flatpak I only have to trust one person and to a much lesser degree, because they declared that the calculator can't access my personal files to begin with. The same app in my distribution repository has full read-write access to all my users files, network access and much more. So yeah, I trust it more.

Distribution maintainers are nothing but a middle man, which don't even audit the code they package, so there's nothing I gain from them.

[ Parent | on HN ]