What exactly is a "premium colourscheme"?
when I coined it, I was thinking about color-schemes that are aesthetic and well maintained.
SpaceVim – Like Spacemacs, but for Vim
181–186 of 186 posts
Re: SpaceVim – Like Spacemacs, but for Vim
#182Re: SpaceVim – Like Spacemacs, but for Vim
#183Earlier quoted context omitted.
Do you never install any software outside Debian's main apt repos? Never add a 3rd-party apt repo for anything that maybe you didn't trust as much? Never clone a git/hg/svn/etc. repo from somewhere and build & install the software yourself? Ok, let's say you don't do any of that. The Debian developers are still fallible, and they certainly don't audit the source code of everything they package. Sure, you have to trus…
> The Debian developers ... don't audit the source code of everything ... Strawman. If an amount of critical code is audited (and it is) it's still much better than nothing. > I want to know if the script is going to accidentally clobber any existing files Packages are tested on various hosts and architectures. The packaging system check for files being overwritten and that the package can be removed cleanly Also sus…
> Strawman. If an amount of critical code is audited (and it is) it's still much better than nothing.
Is it, though? I'm specifically thinking about the Debian fiasco a few years ago when a packager broke OpenSSL's key generation. Clearly less scrutiny is paid than one might think. I'm unable to find any evidence/documentation/anything that suggests that code audits by Debian packagers of critical packages are done regularly (or ever).
I did find a few links to some Debian-specific tools to aid code auditing, but nothing to suggest where they're used, how often, and on what packages. Regardless, they look more like linters and static analyzers -- nothing that would help you discover backdoors or just flat-out malicious behavior.
> The packaging system check for files being overwritten...
Yes, I'm well aware, not sure why you're bringing this up. I was merely pointing out (regardless of any other argument being made) that file-clobbering is a reason why "curl | sh"-style installation bothers me, personally, much more than possible security considerations, which I consider to be overblown.
Re: SpaceVim – Like Spacemacs, but for Vim
#184Earlier quoted context omitted.
Do you never install any software outside Debian's main apt repos? Never add a 3rd-party apt repo for anything that maybe you didn't trust as much? Never clone a git/hg/svn/etc. repo from somewhere and build & install the software yourself? Ok, let's say you don't do any of that. The Debian developers are still fallible, and they certainly don't audit the source code of everything they package. Sure, you have to trus…
> Do you never install any software outside Debian's main apt repos? Only the official repos, yes, because anything else would be insecure. > Never add a 3rd-party apt repo for anything that maybe you didn't trust as much? Heck no , never, ever. Not even once. That's insanely foolish. Frankly, I view, 'please add my PPA/repo to install' as a different way of saying, 'I don't know enough about security for the softwar…
Cool, then you actually are "paranoid" enough (sorry, not trying to use that word in a pejorative manner). I frankly don't think most people are, and I don't necessarily think that's as dangerous as some might make it out to be.
How do you end up dealing with things that aren't packaged for your distro? Do you end up downloading source, doing some checks to whatever level makes you comfortable, and package yourself? Or do you mostly either not find yourself in that situation, or just take an "oh well, I'll deal without it" attitude.
I use a few 3rd-party repos, though ones that I would consider more trustworthy than a random PPA (for example, Google's Chrome apt repo). I certainly don't trust them as much as Debian's official repos (but, again, I'm not sure how much that trust is actually rational!), but I'd consider it unlikely that Google would get compromised or slip something nasty in (and even if they did, it's not like the Chromium source in the Debian repo has been audited).
> I view that as somewhat different, given that the source is there and has a weakly-cryptographically-secure history (weak because it's SHA1), so that if someone ever did something bad then it'd be easy to prove it.
That's all well and good, but that sounds like an after-the-fact reactionary thing. It's little comfort to be able to prove something bad happened after you've been owned.
I just feel like most of desktop security, even on Linux is on pretty shaky ground, and we greatly overestimate the care we take when installing software. I think you're probably ahead of most people by using only official repos, but it's like the classic analogy of a chain with a single weak link: all it takes is one "git clone" of something that does something malicious, and that's it. Sure, the probability of a successful attack is reduced by avoiding 3rd-party repos, etc., but attack possibilities are still very much there, and it feels like people don't seem to see that.
But, overall, yeah, the state of desktop security wrt software installations is so much better on nearly any Linux distro than common practice on Windows or macOS, it's crazy.
Re: SpaceVim – Like Spacemacs, but for Vim
#185Re: SpaceVim – Like Spacemacs, but for Vim
#186spacevim.org is getting blocked by my work's OpenDNS due to a 'security threat'. I wonder why?