5 ms·

That is a way to see it. I see it differently, for me the main issue is the fact that people run random software that were not even vetted. If you dnf/apt ins

That is a way to see it. I see it differently, for me the main issue is the fact that people run random software that were not even vetted. If you dnf/apt install everything from the official repos of your distro, you wont have any misbehaving apps. And that model still holds. And as I explained, other security models don't work either. People will just whitelist the app, or click "Accept" anyway, because they want the feature now! What's the point of nagging with a modal window "your random app, that you installed from a random website on the internet, which means you really want to use this specific app, is behaving in a shady manner, are you okay with this?"

bamboozled 5y ago
If you dnf/apt install everything from the official repos of your distro, you wont have any misbehaving apps. And that model still holds. How do you know this? I hear this a lot, I've built packages myself, only because I needed them in a hurry. I never really went through the source code to make sure it's safe. Maybe others did, but I didn't, people installed the package, maybe they were hacked, who knows? Just saying...
- acatton 5y ago
  When a package lands in Debian Sid or in Fedora Rawhide, there is a group/subculture of nerds who like to inspect it and report any misbehaviour. [1] [2] I usually do this directly on the source project, but some people in this subculture do it in their distro. Also I'm surprised your packages landed in Debian/Fedora, because there is a review process… I'm not talking about a ppa repo or a copr repo, anybody can run that. I'm talking about packages in the official repositories. Installing software from a random ppa or copr repo is the same as curl | sudo sh, nobody vetted this. [1] Type of bugs they report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792580 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792580 [2] https://www.fsf.org/blogs/community/who-actually-reads-the-code https://www.fsf.org/blogs/community/who-actually-reads-the-c...
  - bamboozled 5y ago
    If you think of the millions of lines of code these people are just looking at, you'd have to be pretty damn good to pickup everything? Thanks for sharing
OJFord 5y ago
> And as I explained, other security models don't work either. People will just whitelist the app, or click "Accept" anyway, because they want the feature now! What's the point of nagging with a modal window "your random app, that you installed from a random website on the internet, which means you really want to use this specific app, is behaving in a shady manner, are you okay with this?" At least they get the choice? If they need something so badly they're happy to give it whatever permissions, fine, but at least they're aware and consented. I don't know why you think nobody ever would decline, I and I assume many people do on mobile devices. Especially now that more recent (Android anyway) versions allow/require a sort of 'progressive' acquiring of permissions, prompt when it's needed and not before. Apple & Google clearly think some people want to decline some of the time (and enough that it should be an option), or at least that it's a good way to deliver awareness.

bamboozled 5y ago

If you dnf/apt install everything from the official repos of your distro, you wont have any misbehaving apps. And that model still holds. How do you know this? I hear this a lot, I've built packages myself, only because I needed them in a hurry. I never really went through the source code to make sure it's safe. Maybe others did, but I didn't, people installed the package, maybe they were hacked, who knows? Just saying...

acatton 5y ago
When a package lands in Debian Sid or in Fedora Rawhide, there is a group/subculture of nerds who like to inspect it and report any misbehaviour. [1] [2] I usually do this directly on the source project, but some people in this subculture do it in their distro. Also I'm surprised your packages landed in Debian/Fedora, because there is a review process… I'm not talking about a ppa repo or a copr repo, anybody can run that. I'm talking about packages in the official repositories. Installing software from a random ppa or copr repo is the same as curl | sudo sh, nobody vetted this. [1] Type of bugs they report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792580 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792580 [2] https://www.fsf.org/blogs/community/who-actually-reads-the-code https://www.fsf.org/blogs/community/who-actually-reads-the-c...
- bamboozled 5y ago
  If you think of the millions of lines of code these people are just looking at, you'd have to be pretty damn good to pickup everything? Thanks for sharing

OJFord 5y ago

> And as I explained, other security models don't work either. People will just whitelist the app, or click "Accept" anyway, because they want the feature now! What's the point of nagging with a modal window "your random app, that you installed from a random website on the internet, which means you really want to use this specific app, is behaving in a shady manner, are you okay with this?" At least they get the choice? If they need something so badly they're happy to give it whatever permissions, fine, but at least they're aware and consented. I don't know why you think nobody ever would decline, I and I assume many people do on mobile devices. Especially now that more recent (Android anyway) versions allow/require a sort of 'progressive' acquiring of permissions, prompt when it's needed and not before. Apple & Google clearly think some people want to decline some of the time (and enough that it should be an option), or at least that it's a good way to deliver awareness.