3 ms·

Yes, that is totally how software distribution should work. Vendors cannot be trusted, this has been proven over and over and over again. Having a dispassionate

Yes, that is totally how software distribution should work. Vendors cannot be trusted, this has been proven over and over and over again. Having a dispassionate third party do the packaging keeps malware out of your computer. This is why we have browser extensions and android apps that spy on you. This is why we have a snap which was mining cryptocurrency on your computer a few weeks ago. This is why Mozilla can add spyware to Firefox. Vendor publishing is fundamentally broken.

AnIdiotOnTheNet 8y ago
Well, you're free to believe that a platform that places you at the mercy of third party comrades who dictate what you can and cannot install or distribute "for your own good" is a good idea. I disagree. Wholeheartedly.
- Sir_Cmpwn 8y ago
  We're not talking about some shady organization in some ivory tower. Package maintainers are people whose names and email addresses are available to you. Distros are also always looking for volunteers, you can volunteer and steer things the way you want. And if not, then there are dozens of other distros to choose from whose maintainers may agree with you more.
  - AnIdiotOnTheNet 8y ago
    Yes, and look at how well all that fragmentation works. We're clearly of very different opinions about what personal computing is all about.
    - taway234252 8y ago
      Without the "fragmentation" the problem of third parties censoring applications would be even worse and it still wouldn't be any easier to deploy anything. If you want a proprietary centralized service loaded with malware, there are already plenty of those to choose from on other systems, complete with their own gatekeepers.
      - AnIdiotOnTheNet 8y ago
        Neither MacOS nor Windows prevent you from installing any application you desire[0], direct from the vendor. That has only recently begun to change thanks to app stores, which bear a remarkable similarity to package repos. [0]Ok, there are some hoops regarding unsigned drivers.
Boulth 8y ago
> This is why Mozilla can add spyware to Firefox. Mozilla has some interesting technical solutions to this problem: https://wiki.mozilla.org/Security/Binary_Transparency https://wiki.mozilla.org/Security/Binary_Transparency
- Sir_Cmpwn 8y ago
  Mozilla is the one adding the spyware, though. https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-in-firefox/ https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i... >Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit.
  - Boulth 8y ago
    And upstream issues such as this one should be fixed in upstream not patched endlessly with every other distro. That's the approach promoted by Arch Linux.
    - Sir_Cmpwn 8y ago
      My point is that upstream can't always be trusted. With snaps there's no one between you and a potentially bad actor.
      - Boulth 8y ago
        If you don't trust upstream why are you running their code? I don't think it's reasonable for such a small group of people as Debian developers (or any other maintainers) to review each change looking for potentially malicious code. Especially in codebases as big as Firefox.

AnIdiotOnTheNet 8y ago

Well, you're free to believe that a platform that places you at the mercy of third party comrades who dictate what you can and cannot install or distribute "for your own good" is a good idea. I disagree. Wholeheartedly.

Sir_Cmpwn 8y ago
We're not talking about some shady organization in some ivory tower. Package maintainers are people whose names and email addresses are available to you. Distros are also always looking for volunteers, you can volunteer and steer things the way you want. And if not, then there are dozens of other distros to choose from whose maintainers may agree with you more.
- AnIdiotOnTheNet 8y ago
  Yes, and look at how well all that fragmentation works. We're clearly of very different opinions about what personal computing is all about.
  - taway234252 8y ago
    Without the "fragmentation" the problem of third parties censoring applications would be even worse and it still wouldn't be any easier to deploy anything. If you want a proprietary centralized service loaded with malware, there are already plenty of those to choose from on other systems, complete with their own gatekeepers.
    - AnIdiotOnTheNet 8y ago
      Neither MacOS nor Windows prevent you from installing any application you desire[0], direct from the vendor. That has only recently begun to change thanks to app stores, which bear a remarkable similarity to package repos. [0]Ok, there are some hoops regarding unsigned drivers.

Boulth 8y ago

> This is why Mozilla can add spyware to Firefox. Mozilla has some interesting technical solutions to this problem: https://wiki.mozilla.org/Security/Binary_Transparency https://wiki.mozilla.org/Security/Binary_Transparency

Sir_Cmpwn 8y ago
Mozilla is the one adding the spyware, though. https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-in-firefox/ https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i... >Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit.
- Boulth 8y ago
  And upstream issues such as this one should be fixed in upstream not patched endlessly with every other distro. That's the approach promoted by Arch Linux.
  - Sir_Cmpwn 8y ago
    My point is that upstream can't always be trusted. With snaps there's no one between you and a potentially bad actor.
    - Boulth 8y ago
      If you don't trust upstream why are you running their code? I don't think it's reasonable for such a small group of people as Debian developers (or any other maintainers) to review each change looking for potentially malicious code. Especially in codebases as big as Firefox.