𝕽𝖚𝖆𝖎𝖉𝖍𝖗𝖎𝖌𝖍

       🅸 🅰🅼 🆃🅷🅴 🅻🅰🆆. 
 𝕽𝖚𝖆𝖎𝖉𝖍𝖗𝖎𝖌𝖍 𝖋𝖊𝖆𝖙𝖍𝖊𝖗𝖘𝖙𝖔𝖓𝖊𝖍𝖆𝖚𝖌𝖍 

Ceterum Lemmi necessitates reactiones

  • 6 Posts
  • 603 Comments
Joined 3 years ago
cake
Cake day: August 26th, 2022

help-circle

  • I like this idea, but with the increase in supply chain attacks, I’m reluctant to use it. I’ve been much more reticent about installing from AUR, and my use of github projects has drastically slowed down since I now feel as if I have to read all the source code for everything I get.

    I’ve sandboxed programs before, and I may just start making that standard practice, but still… it makes me angry. It’s, like: this is why we can’t have nice things. There are precious few OSS supply chain static code analysis tools, and there are a lot of languages I don’t know well enough to review, or which have such broad or deep dependency trees that it’s more work than it’s worth. The most frustrating is the dampening effect it’s having on OSS. It only pushes people to only use programs from big commercial companies.

    Anyway, none of that is directly related to your program, which is really cool. Sadly, if there aren’t any positive developments in the OSS ecosystem for attacking the supply chain problem, cool projects like this are not going into my toolbox.