@whitequark which one is the latter?

Reply to @whitequark which one is the latter? on Fri, 08 May 2026 18:51:52 GMT

alwayscurious@infosec.exchange — Fri, 08 May 2026 18:51:52 GMT

@whitequark @navi @SRAZKVT Main problems with Flatpak are:

Some upstreams (you almost certainly not included) don’t update dependencies when there are major security vulnerabilities. For instance, OBS Studio shipped an old CEF that had a Chromium version riddled with exploitable holes.
It only works (well) for graphical applications. CLI tools need hand-written wrappers, and it doesn’t work for daemons, libraries, or embedded devices.
It blocks user namespaces, breaking browser sandboxes. I believe WebKit and Gecko (Firefox) have alternative sandboxing options, but they have more overhead. Chromium doesn’t have an upstream alternative at all, which is unfortunate because it is the most secure browser engine.

Reply to @whitequark which one is the latter? on Fri, 08 May 2026 18:45:20 GMT

alwayscurious@infosec.exchange — Fri, 08 May 2026 18:45:20 GMT

@whitequark I think it is also because big corporations are the ones who see the impact of memory unsafety at large scale. Individuals may be aware that the problem exists, but I suspect most aren’t aware of its scale.

Reply to @whitequark which one is the latter? on Fri, 08 May 2026 18:35:36 GMT

alwayscurious@infosec.exchange — Fri, 08 May 2026 18:35:36 GMT

@navi @whitequark @SRAZKVT Android dynamically links its Rust code. This does require rebuilding programs when their dependencies change, but for a closed system like Android that isn’t a problem.

Reply to @whitequark which one is the latter? on Sun, 19 Apr 2026 09:53:07 GMT

kirtai@tech.lgbt — Sun, 19 Apr 2026 09:53:07 GMT

@whitequark @SRAZKVT
Oh yes, it's by no means an optimisation target, but it's a necessary one nonetheless.

Reply to @whitequark which one is the latter? on Sun, 19 Apr 2026 09:47:53 GMT

whitequark@social.treehouse.systems — Sun, 19 Apr 2026 09:47:53 GMT

@kirtai @SRAZKVT I do not think it is an important optimization target which you reach by sacrificing other goals. if you can do it at all that's good enough

Reply to @whitequark which one is the latter? on Sun, 19 Apr 2026 06:04:18 GMT

kirtai@tech.lgbt — Sun, 19 Apr 2026 06:04:18 GMT

@whitequark @SRAZKVT
I feel that bootstrapping is essential to help counter supply chain and Trusting Trust attacks.

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 21:43:10 GMT

wermi@donotsta.re — Sat, 18 Apr 2026 21:43:10 GMT

@whitequark rust on avr is crazy work. i thought 32bit arm microcontrollers are ubiquitous at this point, am i missing something?

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:16:24 GMT

navi@social.vlhl.dev — Sat, 18 Apr 2026 20:16:24 GMT

@whitequark @SRAZKVT i know what you're doing, yes -- and we've talked before once but that's highly irrelevant

distros don't misled people, it's best efforts, and often enough it works

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:14:07 GMT

navi@social.vlhl.dev — Sat, 18 Apr 2026 20:14:07 GMT

@whitequark rose also has a simple userdb and hostnamed (mostly for the sake of gnome), plus other tools like sysext, sysusers, ukify, and more, all reimplemented, all independent of each other and, obviously, of systemd

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:13:01 GMT

whitequark@social.treehouse.systems — Sat, 18 Apr 2026 20:13:01 GMT

@navi @SRAZKVT gardendevd is interesting

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:12:06 GMT

whitequark@social.treehouse.systems — Sat, 18 Apr 2026 20:12:06 GMT

@navi @SRAZKVT it is a thing that i'm also doing (which you'd know if you paid attention? never talked to you before) but a distro does not have the resources to do this unilaterally, and shouldn't mislead others into thinking it will be effective

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:09:13 GMT

navi@social.vlhl.dev — Sat, 18 Apr 2026 20:09:13 GMT

@whitequark @SRAZKVT

> eudev

here's a complete, albeit still experimental, complete reimplementation of systemd-udev: https://git.pinkro.se/Rose/gardenhouse/gardendevd.git/

made by, a gentoo user, it's capable of booting modern DEs like KDE

> if you mask all critical software

damage control and risk assessment is a thing

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:07:30 GMT

navi@social.vlhl.dev — Sat, 18 Apr 2026 20:07:30 GMT

@whitequark @SRAZKVT

that's exactly the point? there's people using s390, or mips, or riscv, but developers do not care

who does? distros that support those arches, try building software, fixes bugs on said software, send fixes upstream, like gentoo does *all the time*

"number of architectures" isn't an optimization target, there's no target, there's people wanting to use software on systems developers don't think of, know exist, or care about -- and there's distro packagers doing work for their communities to have that happen, sometimes they do it for themselves, most of the time they work on things that they won't ever use, so that their users can

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:07:15 GMT

whitequark@social.treehouse.systems — Sat, 18 Apr 2026 20:07:15 GMT

@navi @SRAZKVT and trying to play maintainer ends up with debian style patchsets that more likely than not just add new the problems, but now in an opaque way

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:06:11 GMT

whitequark@social.treehouse.systems — Sat, 18 Apr 2026 20:06:11 GMT

@navi @SRAZKVT i just don't see there much distro remaining if you mask all critical software exposed to llms. gentoo can't even replace bits of systemd last time i looked into the status of eudev, what hope is there for, like, linux

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:03:56 GMT

whitequark@social.treehouse.systems — Sat, 18 Apr 2026 20:03:56 GMT

@navi @SRAZKVT i do not think that "the number of cpu architectures" is good as an optimization target either. why should i care about s390 users? that benefits ibm and almost nobody else in the end

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:01:50 GMT

navi@social.vlhl.dev — Sat, 18 Apr 2026 20:01:50 GMT

@whitequark @SRAZKVT but there's other examples too, like the shadow package i listed on op

sure the maintainer didn't actually go haywire, but it was caution for weird commits being released

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:01:47 GMT

whitequark@social.treehouse.systems — Sat, 18 Apr 2026 20:01:47 GMT

@andrago @navi @SRAZKVT yeah

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:01:20 GMT

whitequark@social.treehouse.systems — Sat, 18 Apr 2026 20:01:20 GMT

@navi @SRAZKVT but yeah ultimately i don't want unrelated third parties to insert themselves in the software distribution chain and then argue with me on the bugtracker about the correct (as per the infallible distro policy) way of doing things

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:01:10 GMT

navi@social.vlhl.dev — Sat, 18 Apr 2026 20:01:10 GMT

@whitequark @SRAZKVT

and because it's riddled with dubious llms as well as being qt5, source, i talk with gentoo folks basically every day

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 20:00:08 GMT

whitequark@social.treehouse.systems — Sat, 18 Apr 2026 20:00:08 GMT

@navi @SRAZKVT keepassxc is masked on gentoo because it's not on qt6 (source: i forked it and in discussion with the gentoo folks on replacing it). haven't heard anything about it being about protection

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 19:49:54 GMT

chaos@gts.schizofucked.monster — Sat, 18 Apr 2026 19:49:54 GMT

@IngaLovinde @resistor @whitequark yeah we really value how rust's compiler is smarter than we are and points us to the exact issue rather than us having to break out a debugger
makes programming so much less energy intensive, rust's stdlib also maps very nicely to how our brain handles programming, it just requires a bit more upfront thinking of how to structure code/data, def worth the tradeoffs for us esp as we already have very little energy for programming

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 19:38:11 GMT

navi@social.vlhl.dev — Sat, 18 Apr 2026 19:38:11 GMT

@whitequark @SRAZKVT

sure none of it may exclusive from distros, but the point is that distros (should, nay, must) look after their users -- the main point is being communitarian, not under exclusive control of the developer, e.g.

upstreams often don't do releases to fix big regressions, distros can patch those when needed
sometimes upstreams go haywire and the distro attempts to protect the users (newer keepassxc being masked on gentoo)

it's harder to do when the developer has complete control of the distribution method

Reply to @whitequark which one is the latter? on Sat, 18 Apr 2026 19:33:36 GMT

andrago@sk.not-a.cat — Sat, 18 Apr 2026 19:33:36 GMT

@whitequark@social.treehouse.systems @navi@social.vlhl.dev @SRAZKVT@tech.lgbt to add to this discussion, I am a huge flatpak advocate not because the tech is the best, but because it exists and has proven to work giving developers a consistent target for linux systems

you want to package it into your own distro? sure go ahead, but as the underlying dependencies are no longer the same support is up to the developer to decide AND there is a "canonical" build to test these on