@whitequark which one is the latter?

[navi@social.vlhl.dev]

@whitequark @SRAZKVT

and because it's riddled with dubious llms as well as being qt5, source, i talk with gentoo folks basically every day

[whitequark@social.treehouse.systems]

@navi @SRAZKVT but yeah ultimately i don't want unrelated third parties to insert themselves in the software distribution chain and then argue with me on the bugtracker about the correct (as per the infallible distro policy) way of doing things

[whitequark@social.treehouse.systems]

@andrago @navi @SRAZKVT yeah

[navi@social.vlhl.dev]

@whitequark @SRAZKVT but there's other examples too, like the shadow package i listed on op

sure the maintainer didn't actually go haywire, but it was caution for weird commits being released

[whitequark@social.treehouse.systems]

@navi @SRAZKVT i do not think that "the number of cpu architectures" is good as an optimization target either. why should i care about s390 users? that benefits ibm and almost nobody else in the end

[whitequark@social.treehouse.systems]

@navi @SRAZKVT i just don't see there much distro remaining if you mask all critical software exposed to llms. gentoo can't even replace bits of systemd last time i looked into the status of eudev, what hope is there for, like, linux

[whitequark@social.treehouse.systems]

@navi @SRAZKVT and trying to play maintainer ends up with debian style patchsets that more likely than not just add new the problems, but now in an opaque way

[navi@social.vlhl.dev]

@whitequark @SRAZKVT

that's exactly the point? there's people using s390, or mips, or riscv, but developers do not care

who does? distros that support those arches, try building software, fixes bugs on said software, send fixes upstream, like gentoo does *all the time*

"number of architectures" isn't an optimization target, there's no target, there's people wanting to use software on systems developers don't think of, know exist, or care about -- and there's distro packagers doing work for their communities to have that happen, sometimes they do it for themselves, most of the time they work on things that they won't ever use, so that their users can

[navi@social.vlhl.dev]

@whitequark @SRAZKVT

> eudev

here's a complete, albeit still experimental, complete reimplementation of systemd-udev: https://git.pinkro.se/Rose/gardenhouse/gardendevd.git/

made by, a gentoo user, it's capable of booting modern DEs like KDE

> if you mask all critical software

damage control and risk assessment is a thing

[whitequark@social.treehouse.systems]

@navi @SRAZKVT it is a thing that i'm also doing (which you'd know if you paid attention? never talked to you before) but a distro does not have the resources to do this unilaterally, and shouldn't mislead others into thinking it will be effective

[whitequark@social.treehouse.systems]

@navi @SRAZKVT gardendevd is interesting

[navi@social.vlhl.dev]

@whitequark rose also has a simple userdb and hostnamed (mostly for the sake of gnome), plus other tools like sysext, sysusers, ukify, and more, all reimplemented, all independent of each other and, obviously, of systemd

[navi@social.vlhl.dev]

@whitequark @SRAZKVT i know what you're doing, yes -- and we've talked before once but that's highly irrelevant

distros don't misled people, it's best efforts, and often enough it works

[wermi@donotsta.re]

@whitequark rust on avr is crazy work. i thought 32bit arm microcontrollers are ubiquitous at this point, am i missing something?

[kirtai@tech.lgbt]

@whitequark @SRAZKVT
I feel that bootstrapping is essential to help counter supply chain and Trusting Trust attacks.

[whitequark@social.treehouse.systems]

@kirtai @SRAZKVT I do not think it is an important optimization target which you reach by sacrificing other goals. if you can do it at all that's good enough

[kirtai@tech.lgbt]

@whitequark @SRAZKVT
Oh yes, it's by no means an optimisation target, but it's a necessary one nonetheless.

[alwayscurious@infosec.exchange]

@navi @whitequark @SRAZKVT Android dynamically links its Rust code. This does require rebuilding programs when their dependencies change, but for a closed system like Android that isn’t a problem.

[alwayscurious@infosec.exchange]

@whitequark I think it is also because big corporations are the ones who see the impact of memory unsafety at large scale. Individuals may be aware that the problem exists, but I suspect most aren’t aware of its scale.

[alwayscurious@infosec.exchange]

@whitequark @navi @SRAZKVT Main problems with Flatpak are:

1. Some upstreams (you almost certainly not included) don’t update dependencies when there are major security vulnerabilities. For instance, OBS Studio shipped an old CEF that had a Chromium version riddled with exploitable holes.
2. It only works (well) for graphical applications. CLI tools need hand-written wrappers, and it doesn’t work for daemons, libraries, or embedded devices.
3. It blocks user namespaces, breaking browser sandboxes. I believe WebKit and Gecko (Firefox) have alternative sandboxing options, but they have more overhead. Chromium doesn’t have an upstream alternative at all, which is unfortunate because it is the most secure browser engine.