Arch has pacman and that worked so well that it had to have AUR which is just glorified curl | bash. Linux distros managed it for decades when the vast majority of binaries you would run are made by nerds for nerds. If the original maintainer isn't willing to securely package it then you're often SOL.
AUR (also PPA which another comment cited) is emphatically not the same as "just run this script". If anything, and at worst, it's analogous to NPM: it's an unverified repository where the package is run at the whim of the author, and it leaves you subject to attacks against or by that author.
You still, however, know that the author is who they say they are, and that other people (the distro maintainers) believe that author to be the correct entity, and believe them to have been uncompromised. And any such compromise would, by definition, affect all users of the repo and presumably be detected by them and not by you in the overwhelmingly common case.
"Just run this script" short circuits all of that. YOU, PERSONALLY, ALONE have to do all the auditing and validation. Is the link legit? Did it come from the right place? Is it doing something weird? Was the sender compromised? There's no help. It's all on you. Godspeed.
> You still, however, know that the author is who they say they are
This doesn't mean anything since "who they say they are" is an anonymous username with no real life correlation. Might as well be completely anonymous.
> that other people (the distro maintainers) believe that author to be the correct entity
No? Anyone can make an account and upload to AUR and it has exactly 0% to do with the distro maintainers. Packages can be removed if they're malicious, but websites can also be removed via browser-controlled blacklists (which I don't like btw but it's how it works nowadays).
> And any such compromise would, by definition, affect all users of the repo and presumably be detected by them and not by you in the overwhelmingly common case.
This is true of a popular website that advertises install instructions using curl | bash as well.
I've been using Linux for the past 2 decades and my general experience is that it is in no way more secure than Windows or Mac, just way less popular and with a more tech savvy userbase.
> This doesn't mean anything since "who they say they are" is an anonymous username with no real life correlation.
No, that's affirmatively incorrect. AUR and PPA both require authenticated accounts. The "real life correlation" may be anonymous to you, but it is trackable in a practical sense. And more importantly, it's stable: if someone pushes an attack to AUR (or NPM, whatever) the system shuts it down quickly.
And the proof is THAT IS EXACTLY WHAT HAPPENED HERE. NPM noticed the Axios compromise before you did, right? QED. NPM (and AUR et. al.) are providing herd protection that the script-paste hole does not.
Those scripts you insist on running simply don't provide that protection. The only reason you haven't been compromised is because you aren't important enough for anyone to care. The second you get maintainership over a valuable piece of software, you will be hacked. Because you've trained yourself to be vulnerable and (especially!) becuase you've demonstrated your softness to the internet by engaging in this silly argument.
And, you were wrong, so I said so. Indeed this is a very frustrating site to post incorrect points. It's like ground zero for Cunningham's Law study cases.
Again, I'm really not understanding your offense here. You came to me to disagree with something I posted. And as it happened you were wrong. I told you so, and you dug in twice with more incorrect takes. That's just... discussion. And frankly pretty polite discussion even by the standards of this site (which is pretty polite!).
There's no etiquette that demands I not tell you you're wrong.
No, I agree with him. Everyone knows Russia has territory inside Europe. Does that make it European? Post-Ukraine not a lot of people would call it European. It's just a word at the end of the day, the politics are more important to people that geography since both are made up. Why does Europe end at the Ural mountains? Because we said so.
All Europeans know what is meant by Europe. We just don't agree on it. But it does mean "not US or someone hostile to us" and that's enough of a definition without splitting hairs about Belarus.
This is a really interesting question. Is it? My intuition would say no since you have no inherent duty to protect or help others. I have no clue though.
If there's no downside to leaving the ladder in place, then I would think yes - there's a reasonable expectation that people will die due to your actions. You'd likely have to argue about "involuntary manslaughter" vs something more intentional though, depending on circumstances.
If there is a reasonable downside, probably no? You have a right to try to keep yourself alive, in nearly all contexts.
Is this the first time you have ever thought about the idea of supply chain attacks? This is the first thought 90% of people have and it doesn't work. Too much work to manually verify diffs and LLMs aren't good enough at this yet.
No, I think about it all the time. It’s just baffling that this kind of attack is still a thing, after a decade+ of this happening over and over again.
If ChatGPT can make a good plan for you from 5 bullet points, why was there a ticket for making a plan in the first place? If it makes a bad plan then the coworker submitted a bad plan and there's already avenues for when coworkers do bad work.
If the documents they're putting out are bad, then they're doing bad work and that eventually comes with consequences from your coworkers and superiors. If they're doing good work, then great! Who cares if an LLM wrote most of it and they just edit it? That's not super different than the current relationship between senior and line workers.
I guess I'm making some assumptions here. But I've been asked to review some documents before. Maybe I didn't notice the ones that were good. But my general assumption is that if someone gives me the output of an LLM to review, it's not going to be good work. In my experience it hasn't been good work generally.
> So I guess the takeaway is: if elections are so close that a tiny amount of voters sway them, the problem of polarization is already pretty extensive enough that AI probably isn’t going to make it much worse than it already is.
To rephrase: things are so bad they can't get worse. But the beauty of life is that they always can!
I can't say I agree fully with the original video either but this is just blatantly trying to reframe the same facts presented in said video, but placing the blame on consumers rather than businesses, which is a really dirty tactic.
> Sysco serves poor quality products. They also serve great quality products. Remember, if restaurants are buying poor quality products, it’s because it’s all you, the consumer, will pay for.
"feel bad about being poor"
> Again, animal welfare is not a Sysco issue. Sysco offers countless sources for humanely-raised meat. And, as always, as a consumer, if you want to be really sure: stop eating meat, and tell everyone you know to do so as well.
"feel bad about eating meat"
> Ironically, the foods analyzed in the video as a sign of “quality” are fried pickles, jalapeño poppers, and funnel cake fries. These are inherently low-quality processed foods that no one in their right sobriety should be eating.
"feel bad about food choices"
> The More Perfect Union narrative stops just short of calling Sysco a monopoly. They’re not. They only control 35% of the market
"only 35%"
I mean, c'mon.. was this written by a real person or Adam Smith come back from the grave?
Getting rid of Sysco isn't going to magically make them able to afford pricier options either.
>"feel bad about eating meat"
Feeling bad about eating meat feels bad, but if meat production is ethically and environmentally questionable why should we let the consumers off the hook? Should we let gas guzzling SUV drivers off the hook as well for their choices because it might make them feel bad? Better blame a faceless corporation instead so we can feel smug while not changing our lifestyles at all. After all, ExxonMobil could have theoretically synthesized carbon neutral gasoline, rather than pumping it out of the ground (never mind the cost), so the blame lies with them.
My point was that this is just the same tactic that corporations have been using for decades. For example, rather than fix systemic issues that cause them to dump mass amounts of greenhouse gases or toxic waste, they instead reframe the issue so that the consumer is at fault: "you don't recycle enough". This is the same, it's just reframing corporations cutting costs wherever they can as the fault of the consumer rather than just plain entshittification. For the record I agree with your point about eating meat and such, it's just not relevant to the discussion at hand and used just as a cheap appeal to emotion/shame.
>For example, rather than fix systemic issues that cause them to dump mass amounts of greenhouse gases or toxic waste, they instead reframe the issue so that the consumer is at fault: "you don't recycle enough".
This is a strawman. Even before "recycling is a lie" entered into the zeitgeist a few years ago, approximately nobody thought people failing to recycle led to greenhouse gas or toxic waste, or that recycling was going to prevent those things. At best they did it out of some vague sense of "environment". If pressed they'll probably say something about landfill space or sea turtles, but I doubt they thought recycling was going to stop global warming, or clean up the polluted rivers in China/India.
>This is the same, it's just reframing corporations cutting costs wherever they can as the fault of the consumer rather than just plain entshittification.
To some extent it is the fault of the consumer. Restaurants are a competitive market with low barriers to entry. If consumers actually want unique local flavors an non-frozen foods, and are willing to pay a premium for it, sysco would have never gotten a foothold. Sure, cheap frozen food is objectively bad and you'd have a tough time finding someone who'd explicitly say "yes, I do want reheated frozen food at restaurants", but if people are willingly choosing it, then it's just demonstrating expressed preference vs revealed preference. The fact that mcdonalds serves cheap low quality food (compared to even something like olive garden) can't be blamed on "plain entshittification".
> If consumers actually want unique local flavors an non-frozen foods, and are willing to pay a premium for it, sysco would have never gotten a foothold.
This is rooted in the assumption that capitalism provides what people want, rather than the worst that they will still accept. Endlessly cutting costs and then blaming the tastes of the consumer is why people put out anti-corporation pieces like the original video. That is not to say that Sysco is not operating logically.. but if the best move in a system leads to an unfavourable outcome for those that should benefit from it, then the system itself is the problem. Or another way to phrase it: there is a reason why that video resonated with many people that goes beyond trying to blame others for your problems.
>This is rooted in the assumption that capitalism provides what people want, rather than the worst that they will still accept.
Can you really say people "want" more expensive/unique/non-frozen food when they choose the cheap one every time? It's like with flights. People complain about how shitty flying is, but most people are also sorting by price and buying the cheapest.
I think it's kind of a lemon market effect. I could pay 50 more for a flight but how do I know I'll have more leg room anyway? Maybe they'll just upcharge me. Same for restaurants if you're a traveler and don't have time to get familiar with the reputation.
You can go off marketing, but every place will try to present it's food as unique and well crafted even if it's premade.
I actually don't really care about the SUV drivers themselves and care far more about the companies that stopped selling other types of car, because of government policies that incentivized them to do so.
Individuals can't reasonably be blamed for systemic problems.
From now until the death of humanity, someone is going to make this statement every day, about every post, until I just can't take it anyone and pass away from exhaustion.
BTW, despite disagreeing with you on this topic, I read other parts of your blog and, as somebody else who experiences manic episodes, I actually more or less 100% agree with your "Core Beliefs" section. I've seen this before in other people I've met like me, but it does make me wonder about the nature of manic states and nature/nurture. Do these beliefs trigger individuals to enter manic states, or is predisposition to manic states something that makes individuals adopt this set of beliefs? The subtitle of your blog is "wired differently", but the weird part is many people are wired differently but in vastly similar ways.
I think the two are uncorrelated. I don't think that most people prone to mania would agree with our beliefs. I think it has more to do with us posting on HackerNews thus being interested in similar topics.
