3 ms·

I've seen enough of these over the last two decades, between Ubuntu/Debian and RedHat, that I use and inherently trust other distros more. Just compile the sou

I've seen enough of these over the last two decades, between Ubuntu/Debian and RedHat, that I use and inherently trust other distros more. Just compile the source packages. If there is some issue, file a bug. Monkey patching everything silently leads to things like this, which I've never experienced with distros like Arch, Void, or Solus.

vbezhenar 3y ago
For helm and most other golang apps, you just need to download and put binary into your $PATH. They usually put them onto github releases, so it's really low friction way to install a genuine application. Now to keep them updated is another story.
- silisili 3y ago
  Last sentence. I love Go's install and run story, but keeping it up to date is a pain. We trust, or used to trust, distros for this. Why are they messing with the source?
  - xavxav 3y ago
    My understanding is that they've more or less always done this for various reasons: security patches, compatibility, dependency versioning. I understand the historical reasons that led to this structure for package management, especially with how brittle C dependencies seem to be, but I truly hate this practice. It seems to make it exceptionally difficult for authors of major software to establish any sort of invariants or security boundaries.
sneak 3y ago
Debian is very very diligent about patching out phone-home and expiration timers and other such “developer knows best” misfeatures. Some apps also include autoupdate (aka solarwinds style RCE) which they also remove. Overall they do way more good than harm. Trashing them because they sometimes make mistakes is probably incorrect.
- p_l 3y ago
  But when they get it wrong, they can get it catastrophically wrong - like breaking ssh-keygen so that for given set of parameters there existed only 2^32 keys.

3 ms·

I've seen enough of these over the last two decades, between Ubuntu/Debian and RedHat, that I use and inherently trust other distros more. Just compile the sou

by silisili 3y ago

vbezhenar 3y ago
For helm and most other golang apps, you just need to download and put binary into your $PATH. They usually put them onto github releases, so it's really low friction way to install a genuine application. Now to keep them updated is another story.
- silisili 3y ago
  Last sentence. I love Go's install and run story, but keeping it up to date is a pain. We trust, or used to trust, distros for this. Why are they messing with the source?
  - xavxav 3y ago
    My understanding is that they've more or less always done this for various reasons: security patches, compatibility, dependency versioning. I understand the historical reasons that led to this structure for package management, especially with how brittle C dependencies seem to be, but I truly hate this practice. It seems to make it exceptionally difficult for authors of major software to establish any sort of invariants or security boundaries.
sneak 3y ago
Debian is very very diligent about patching out phone-home and expiration timers and other such “developer knows best” misfeatures. Some apps also include autoupdate (aka solarwinds style RCE) which they also remove. Overall they do way more good than harm. Trashing them because they sometimes make mistakes is probably incorrect.
- p_l 3y ago
  But when they get it wrong, they can get it catastrophically wrong - like breaking ssh-keygen so that for given set of parameters there existed only 2^32 keys.