| ▲ | cyberclimb an hour ago | |
> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access... Realistically most users? It's already quite a technical barrier to run Arch Linux, and the knowledge to further know about/understand PKGBUILD can only comes with time and is yet another layer filtering people's ability to know how to even try to catch something malicious. Now consider the layer of even experienced user that's in a bit of rush and doesn't have time to review the full diffs they're upgrading to. Ralistically it's nearly statistically impossible that 100% of users would be able to all catch and block a given exploit themselves. A shared responsibility model of security [1] comes to mind, and while it's great for users to be active participants in their security, their action/awareness should be a last resort. I wouldn't blame the user. [1] https://docs.cloud.google.com/architecture/framework/securit... | ||
| ▲ | embedding-shape an hour ago | parent | next [-] | |
> doesn't have time to review the full diffs they're upgrading to. Again, why are people expecting that you need to review the entire thing? You don't have to, you have to look at the download source (a github organization or a domain name or a cdn bucket) and look at what dependencies/other junk it pulls in. Usually this is 3-5 lines at max, and usually only the binary/source is taken from github/server, the rest is from official Arch repositories. Of course it's unrealistic to expect users to review 100% of the code they run on their machine, that's why no one is expecting this, nor claiming that users should do this. But reviewing 3-5 lines when installing software from literal strangers on the internet, isn't so much to ask. | ||
| ▲ | matheusmoreira an hour ago | parent | prev [-] | |
> It's already quite a technical barrier to run Arch Linux People are supposed to clear that barrier by studying the Arch Wiki and other technical materials so that they understand what they are doing, why they are doing it, and the risks involved. When they install random software pushed by random people they know nothing about much less trust without even so much as a glance at the PKGBUILD, they're not overcoming any barriers, they're YOLOing their personal computers and hoping it turns out fine. > I wouldn't blame the user. I would. They were warned. | ||