I used to do this too, I confirm this works and is a good idea, it is convenient especially if you plan to distrohop a bit or know you will reset a couple times to experiment a bit

Not just that, but any kernel crash could turn off a potentially security related machine

Systemd

Learn linux like everybody first, install an easier distro like debian or mint, play with that. After a few months delete everything and reinstall domething else. Keep data on external disk to not loose it. This is the way to learn. Do not learn to unicycle before knowing how to walk.

This is what we get when a new user comes to the linux community saying they are new to linux, need to choose a distro, mostly care about security and don’t trust their parents network.

Some idiot says they should use qubes, and they do it…

OP stop the madness, install debian or mint, use it a few monts and reinstall something else afterward. You will learn and all this will make sense, but you need to first sweat it like everybody else.

I think you are right, but IMO the reason is just a difference in numbers. If crate.io ever gets as much users as npm the problems will become exactly the same.

As soon as there is a situation where one dependency can decide tomorrow to pull in another one everybody is screwed. You might be comfortable with understanding the code, but if you don’t have the time to fix it you are screwed either way. The customer always says “it worked yesterday, what do you mean you need to fix something? Work on this new feature instead”. One year of this any you cannot manage your dependencies anymore and you have hundreds, welcome to npm.

What are the differences between cargo and npm that make you approve of the former and disapprove the latter?

Imo the package manager is one of the things in rust that it is holding back the most. Cargo, like npm is something that rapidly causes loss of control over dependency management, because your dependencies find it too easy to pull in more shit. That is an OS job, not a first class citizen of a language

Imo any attacker that has access to the hardware cannot be countered by software. There always is a badusb or sodder this here chip type attack possible against any attempt at locking up your pc.

You can encrypt and backup, but any legends about tpm, bios passwords, weird hardware encryption features and keys are moot once an attacker can read what transits on the pcie or memory bus

That is not how any of this works. You don’t bring down a datacenter to patch it, then bring it back up like doing updates on grandmas pc.

Do not use Flatpack, it causes more problems than it solves, especially if you don’t know what you are doing

Debian is unable to manage modern dependency trees because they chose not to. It is fucking embrarassing what happens with any “normal and modern” thing in cargo, npm or other cursed repository pulling in 2000 dependencies you have absolutely no hope in being able to vet for malware or stupid bugs. This comes on top of a culture of API instability between one minor version and another.

Debian has their packages and those are tested and inspected in depth, regressions are tested. There are people running debian for a job and we don’t want that kind of nonsense.

Ok thought you where a crusader, I am sure you also are against systemd and probably a rust keyboard warrior too eh?

The people running the agent need to be looking at the code and cleaning it, not someone else, that is the key thing that is missing in all these failures. Linux is the same, they would never accept something that has not at least the same quality as something written by a competent human

I am a software dev with more than 10 years of experience I have code in production and need to support legacy systems. I am trying to explain how I found a way to use this stuff in helping me in doing my job and getting food on my family’s table, but sure buddy I don’t know what I am talking about.

Well, my point is that the review should be before the pr, not after.

Disagree on your first point. AI will generate code that is mostly correct, the human time cost of (properly) reviewig this code and correcting it is generally less than also writing it. People that do more serious work than vibe-coding oneshot skateboard simulators in html do actually get noticeable productivity boosts even when every generated line of code is reviewed by multiple people.

That is why the kernel allows it, because they mostly care that a human is around that will take responsability for it, that the patches are of the same quality than always and that everything is manageable by humans. This is in contrast to the techbro github repo with commits that span 20 files and 2k edits where there is no hope in hell to understand what is going on.

Look op, you kind of want to drive around without wanting to put in the work to either lern how a car works or what the road rules are.

Security is not something you install and the you got it.

I highly suggest to learn what the common risks are and how they work, then how to counter them.

This whole security and privacy thing requires both effort and knowledge, that is why corpos fuck over people so much, because they ain’t willing to put in the work to care.

P.s sorry I reread my answer and I come off a bit harsh, what I mean is that by prompting a community like this with your kind of questions like if we were an AI will not work towards getting you good answers. You need to learn first and one of the first lessons is that there is no security and a casual “I will be opening sketchy files”. A better question is: how can I open sketchy files and still be safe?

All I’m saying is that if you want to keep a moral high ground and accuse someone of being a fascist you should at least not put words in their mouth, what they say should be enough. Otherwise it gets to be a witch hunt.

I am not saying he is right, but I do want to point out that is not what he said. He said he no longer wants to live in london because it is full of people “like you”.

Which is kind of a different thing