> In some Linux distros like Debian, everything is illegal/prohibited until you explicitly allow it

Bit of a nitpick, but this is certainly not true of their userspace, where an `npm install` can just install a keylogger or read your ssh keys, or do whatever it wants -- except for updating your video card driver.

▲

dylan604 19 hours ago | parent [-]

I would hope that someone deliberately choosing to run a headless Debian install would be wise enough to not go around running `npm install` willy nilly. In my personal experience, I've never once needed an `npm install` in Debian environment. I've only ever used them in server environments and to be honest thinking about it, that was all pre-npm when javascript was kept where it belonged in your browser and not my server. Someone screwed us all allowing JS on the server, but that's an entirely different conversation.

	▲	gf000 19 hours ago \| parent \| next [-]
		Well, it's enough to use a trusted app as your own user on non-trusted data. The former just has to have a memory vulnerability, which is not rare given most of it is C. So yeah, don't be so confident in it working out. Unfortunately gnu/linux desktop is severally lacking in security (and by desktop I mean a headless personal use as well)
	▲	Xirdus 16 hours ago \| parent \| prev [-]
		I used to run npm install unsupervised from a script on headless Debian that I deliberately chose dozens of times everyday. Later I moved my CI to Alpine.