Thread

1. computator · 1789670801 · focus · HN ↗

   I'd like to use it, but I'm hesitant to use anything that isn't a reviewed and approved package in my Linux distribution. Even if the chance is 1% that a program I download has malware or security problems that even the author doesn't know about (eg., due to libraries used), odds are that my system's going to be compromised if I run 50 such programs. This extends to browser add-ons, bookmarklets, and extensions too.

   How do other people handle this dilemma?

   Even solution I can think of involves are a great amount of extra work.

   1. TeMPOraL · 1789717155 · focus · HN ↗

      > How do other people handle this dilemma?

      For me: consider this a form of paranoia and ignore it, while worrying more about cleanup costs of non-vetted packages.

      Like, even if there is 5% chance that a program I download will start downloading global python or node packages, odds are within a year I'll deal with couple that have mutually incompatible requirements and are impossible to run without more VM surgery than I have patience for, and that I'll discover this only after a botched installation bricks software that used to work before.

      But that's solvable with less extra work. Just throwaway containers. With no hand-wringing about read-only access or isolating it from network, because my threat modeling doesn't consider loss of privacy or any data leak from my personal local side to be realistic or impactful threat event (I mean, everything that matters is in someone else's cloud and by design not trivial to access) - OTOH, it assigns great magnitudes to loss of personal time.

Unofficial Hacker News client; not affiliated with Y Combinator.