points by dylan604 13 hours ago | 0 comments
In some Linux distros like Debian, everything is illegal/prohibited until you explicitly allow it and only comes with the bare minimum of software necessary to make the OS work. Contrast that to other distros like Ubuntu where everything comes preinstalled and is very permissive. These obviously target different audiences. Smart phones are targeting different audiences too. The power users annoyed by the dumb things the device does just means you're not the target audience and are just bonus buyers for their bottom line.
[–] gf000 9 hours ago
> In some Linux distros like Debian, everything is illegal/prohibited until you explicitly allow it
Bit of a nitpick, but this is certainly not true of their userspace, where an `npm install` can just install a keylogger or read your ssh keys, or do whatever it wants -- except for updating your video card driver.
[–] dylan604 8 hours ago
I would hope that someone deliberately choosing to run a headless Debian install would be wise enough to not go around running `npm install` willy nilly. In my personal experience, I've never once needed an `npm install` in Debian environment. I've only ever used them in server environments and to be honest thinking about it, that was all pre-npm when javascript was kept where it belonged in your browser and not my server. Someone screwed us all allowing JS on the server, but that's an entirely different conversation.
[–] gf000 8 hours ago
Well, it's enough to use a trusted app as your own user on non-trusted data. The former just has to have a memory vulnerability, which is not rare given most of it is C.
So yeah, don't be so confident in it working out. Unfortunately gnu/linux desktop is severally lacking in security (and by desktop I mean a headless personal use as well)
[–] Xirdus 5 hours ago
I used to run npm install unsupervised from a script on headless Debian that I deliberately chose dozens of times everyday. Later I moved my CI to Alpine.
[–] hparadiz 5 hours ago