thriqon

Look at https://www.npmjs.com/package/blessed and the -contrib package.

Yes, if you can acquire or verify the checksum via some other means, e.g. PGP or phone.

To confirm unchangedness-in-transit I rely on TLS.

Usually, the packages themselves are not signed with GPG, only the Release file is (containing the hashes of all .deb files). This is actually the default of both Debian and Ubuntu. I never quite understood the reasons behind it... I'd not expect this vuln to happen, though.

More info: https://blog.packagecloud.io/eng/2014/10/28/howto-gpg-sign-v...

RemoteStorage set out to provide exactly this: https://remotestorage.io/

Basically, it provides you with a simple API to store data in a location your user provides (and trusts). This might be in their local network, but could be Dropbox as well.

Haven't checked it out for a while, though...

You could image code like this:

  for (pos = 0; !found; pos++) {
    row = get_next_row();
    if (strstr(row, "user") {
      // this is obviously a header row
      continue
    }
    if (strstr(row, user_name)) {
      found = 1;
    }
  }

So, the problem is not package managers per se, but the velocity of updates? Fix that instead? (see Arch Linux).

Why shouldn't it? ssh can do the same on a remote host, yet no one complains about that ;-)

In which country is he legally able to do so? He shouldn't be able to control everything you do... I've experienced attempts for that, but not all clauses are enforceable.

While I agree with your points when storing timing of (happened in the past) events, but I disagree when storing display preferences for the user. As a user, I do not want to change my timezone settings just because my country went into Daylight Saving.