3 ms·
> great inconvenience It's a convenience/security trade-off, I see. The only solution I've ever seen to that requires investing trust in an "authority" which
by nonrandomstring 4y ago
> great inconvenience
It's a convenience/security trade-off, I see.
The only solution I've ever seen to that requires investing trust in
an "authority" which then becomes corrupt and censorial. One simply
expands the dilemma to a triad; security/freedom/convenience.
If I am not mistaken the PyPI "Cheese Shop" is owned by the Python
Software Foundation, a 501(c3) nonprofit organisation which
constitutionally values Software Freedom highly. It seems natural that
convenience would be sacrificed if security is of concern.
- nine_k 4y agoSuch an authority in the Linux world used to be a distribution. Installing a binary blob provided by Debian build servers is based on decades of trust. But there is a tradeoff between having things thoroughly vetted and tested, and moving fast.
- nonrandomstring 4y agoInteresting point. So as dimensions we now have - security - freedom - convenience - speed/newness Who can build me a UI with four sliders that selects the packages I can install? Bonus: when I move a slider it highlights all the potential packages that changed status with reasons why they are now included/excluded.
- dylan604 4y agoYou're an HN reader, so you should be able to knock this out over a weekend /s
- nonrandomstring 4y agoYou're right the prototype GUI is a weekend of work. But you also know that's not where the work is :) Now some more intelligent comments are coming in we can talk about the analysis and tagging of thousands of packages, dealing with backward compatibility and what happens when naughty malware just hops to another level of trust. But none of that is a call to give up. We just need to think seriously about the problem we face.