4 ms·
> But it could just as easily be malware Everything that can be downloaded could easily be malware. No users verify binaries/compile from line-by-line verified
by ivanjermakov 2mo ago
> But it could just as easily be malware
Everything that can be downloaded could easily be malware. No users verify binaries/compile from line-by-line verified source.
It's always about trust in author and distributor. Curl | bash or AUR or build from source - matters very little.
- zbentley 2mo agoThere’s a big difference between executing something from your package manager—and bluez is packaged by literally every major distribution—and executing: a random binary from a brand new GitHub repo (which you didn’t build and can be swapped out for something evil any time) …that’s actually a different project’s binary rebuilt and renamed/redistributed (or malware) …as root …on a hypervisor. So yes, > It's always about trust in author and distributor Is totally correct. There are different levels of trust. This repo merits very low trust.