Hacker News Reader

Seems valid to want someone to vet your software, especially if it’s capable of self-upgrade. But I also think that’s an expensive process, and one that Google probably doesn’t want to pay for. People seem very up-in-arms about App Store fees but then complain when unmanaged stores produce mounds of garbage and/or malicious software.

I feel Linux distros have this problem solved.

1. Only distribute Free/Open Source software.

2. Only distribute software that somebody is there to package.

3. Allow the users to install other software and shoot themselves in the feet if they so desire.

And absolutely no auto-anything.

Every operation by package manager is a result of explicit user action.

To me it seems like there is a different trend happening - Ubuntu now has snaps which auto update and you no longer can get some software without them, whereas even Debian comes with unattended upgrades enabled in some cloud vendors.

Of course, only security update being enabled isn't such a bad thing, but in my experience and and all updates can break things sooner or later.

By default, many distros already install urgent security patches automatically. I'm pretty sure Debian does it for me, but I cannot remember all of the details.

In 2021, "absolutely no auto-anything" seems to guarantee your host will fall out of compliance and fall prey to hackers. How do you respond?

>This is where I think the traditional Linux package maintainer shines, protecting the user from malicious software. If a package-maintainer (generally independent from the developer) packages software for a Linux distro, the package-maintainer can drop harmful updates. If instead we give the developers free-reign to push updates without user consent, the developers can and will sell out to the highest bidder

Sounds good in theory but that hasn't been battle tested in a mass product used by non-tech savvy people like Chrome extensions that are heavily targeted. On the other hand there have been breaches even in the packaging landscape.

I have never heard of malware actually making into a mainstream Linux distro.

Has this happened? Which distro?

To expand on this, the opposite has been true. IIUC Firefox telemetry is enabled for all binary downloads from Mozilla website by default, but every distdo package manager worth its salt has it disabled. So the system is actually working as intended.

Arch btw, it was in AUR though, cannot blame maintainers.

Note that browser extensions are reviewed by humans, as are updates to them. You also need to pay a nominal fee ($5 by credit card) to submit an extension to the Chrome store, to avoid spammers.

Chrome extensions are generally not subject to human review. I maintained one with 50k+ weekly actives for about 3 years and I think out of probably ~500+ updates I had at most 10 go through human review, and most of those were due to a fraudulent DMCA claim (they started doing manual reviews afterward for a bit, then stopped again)