4 ms·

You really don't see the difference between a deterministic script installing a tarball pinned by its hash, and "sudo chatgpt install master branch of this repo

You really don't see the difference between a deterministic script installing a tarball pinned by its hash, and "sudo chatgpt install master branch of this repo"?

warkdarrior 3mo ago
Yes, the second option gives me an easily inspectable list of results (as I can see all the tool calls the model made). The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations.
- Matl 3mo ago
  Arch is famously x64 only?
  - tyfon 3mo ago
    I run it on my milk-v duo s risk sbc. The risk-v version is maintained by a few dedicated people, and the milk-v specifics I had to fix myself. But it works :)
    - Matl 3mo ago
      I knew there's an unofficial version for ARM. I meant more that the vast majority of AUR packages target x64 only because that's what 'official' Arch supports. That being said, didn't know there's a RISC V effort as well now, so TIL.
- rcxdude 3mo ago
  Most PKGBUILDS are stupidly simple, they're probably easier to read than a set of tool calls. See this for a randomly picked recently updated example: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=battery-charge-limiter https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=batte... (honestly I think the way that arch packages work is really nice compared to most other distros: you can almost copy and paste the README of a project into one and have a package) Here's the most complicated one I found, building a browser: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=flowfox https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=flowf... The main risk, if you're reading them, is typosquatting and hiding the malicious code in what the project downloads.
- ethin 3mo ago
  > The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations. Uh sorry what? Can you point to a PKGBUILD that is indeed this complex?

You really don't see the difference between a deterministic script installing a tarball pinned by its hash, and "sudo chatgpt install master branch of this repo"?

warkdarrior 3mo ago

Yes, the second option gives me an easily inspectable list of results (as I can see all the tool calls the model made). The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations.

Matl 3mo ago
Arch is famously x64 only?
- tyfon 3mo ago
  I run it on my milk-v duo s risk sbc. The risk-v version is maintained by a few dedicated people, and the milk-v specifics I had to fix myself. But it works :)
  - Matl 3mo ago
    I knew there's an unofficial version for ARM. I meant more that the vast majority of AUR packages target x64 only because that's what 'official' Arch supports. That being said, didn't know there's a RISC V effort as well now, so TIL.
rcxdude 3mo ago
Most PKGBUILDS are stupidly simple, they're probably easier to read than a set of tool calls. See this for a randomly picked recently updated example: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=battery-charge-limiter https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=batte... (honestly I think the way that arch packages work is really nice compared to most other distros: you can almost copy and paste the README of a project into one and have a package) Here's the most complicated one I found, building a browser: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=flowfox https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=flowf... The main risk, if you're reading them, is typosquatting and hiding the malicious code in what the project downloads.
ethin 3mo ago
> The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations. Uh sorry what? Can you point to a PKGBUILD that is indeed this complex?