AOSP has network as a regular permission for apps, so on Lineage at least (idk about Graphene as I haven't used it) you can disable network for any app including google play services etc. I have no idea why most phone companies remove this permission from their roms but android itself supports it perfectly fine.
The PKGBUILD files specified npm as a dependency, so it would've been installed prior to installing the malicious file, so not having npm is by no means a guarantee.
To be fair in this case it looks like npm was used as a way to run arbitrary code in a way that wouldn't look out of place immediately in a PKGBUILD file. All of this could have been done from within the install hook or anywhere else really in the PKGBUILD, it would've just been more obvious at a cursory glance if there was now randomly a curl | bash in the file.
Tools exist (e.g. pkgctl) to allow you to test building and installing the package on a clean image to catch these kinds of things, maintainers should really be using these before publishing.
In my experience as someone who rides a bike with hydraulic disc brakes and drives frequently, they really don't stop very quickly. I pretty much always am more confident I can stop my car faster. The bike may have a lot less mass but it also has a lot less traction and it's much easier to lock up a wheel and skid instead of stopping quickly, especially in poor conditions/on road paint. I do cycle fairly fast, but this is on a mountain bike on the road, certainly not fast compared to a fit person on a road bike.
I will give you that they're much more maneuverabile and accidents can often be avoided by putting the bike into a space in the road that a car couldn't go into.
You say it requires a little acclimatisation, but the caller may well just not know anyone with that specific accent/have never had the chance to acclimatise to it other than this phone call, there's an awful lot of accents in the world.
Additionally I find even though I can understand an Indian accent for example quite well in person, I really struggle with it over the phone due to the compression causing quite poor sound quality and lack of facial expressions to be able to read (which I would be using in person to help me understand a strong unfamiliar accent), whereas when accent is more familiar to me, the poor audio quality and lack of body language isn't nearly as much of an issue, presumably as I just have way way more exposure to the accent so can fill in gaps better.
The whole thing with GPL code seems like a mess and surely couldn't be set as actual precedent, right? It is totally infeasible for me to check every single GPL project on every code hosting platform to see if the code Claude etc produced is too similar. If a set of training data used for the model was released to check against that would be one thing, but you can't honestly expect someone to check every repo available from all time to see if a model (that you are not informed of what it was trained on and therefore could reproduce) might've reproduced code from it.
That's not at all like checking the dependency chain of a dependency or anything as you can just read the licence of anything you're choosing to use. Surely the precedent would have to be that a model trained on GPL code has itself been infected by GPL, and therefore must have all source/weights released too if the assumption here is that it can have embedded the code well enough to be able to reproduce it?
It sounds like the real solution to this is to be able to control permissions at an OS level for network per app, as you would be able to do if you had root access. I have no idea why regular Android distros don't allow you to do this, it seems like a really sensible thing to expose in app settings given the permissions model of Android.
The difference I see there is any line in a C codebase could have these issues, whereas in Rust they're specifically marked as unsafe sections, with the language having a clear list of invariants it expects the programmer to uphold in an unsafe block. Additionally Rust has a culture of developers specifically justifying the unsafe block and why it's correct in comments. It's a massive reduction of the scope of the code that needs audited, that doesn't mean there can't be mistakes in it, just that it's easier to verify certain properties of the whole codebase.
What all these breaches tell me is that personal data should not be required, and especially not stored unless absolutely necessary. I cannot verify how my data is treated once it leaves my device, so how can I possibly trust it will be treated properly and not leaked?
This is a major reason as to why I am so strongly against all this verification shit governments keep trying to push, the best way to keep data secure is not to have it in the first place, therefore my personal data should not leave my device except in the strictest of circumstances for things like my name/DOB/address/SSN.
I find that a lot less problematic as there's just very few shorts on my feed, I've never been able to scroll through more than 5 or so without just going into ones I've seen before.
Funny enough it's the OS and manufacturer I don't trust with my phone, with my PC I trust them a lot more as they're much more open and I can choose the OS.
What's always got me about this is when I was in school I had it absolutely drilled into me that I should never expose personal information online to anyone, I completely saw the logic in that and so heavily limit the personal data I give out. Now we're just expecting people to completely go against that and give away the most personal details possible to companies who cannot prove what they are or are not doing with it just because governments have decided that's best now?
And how do they prove to me they (and no 3rd party providers) aren't actually storing the data? I simply don't trust companies telling me they won't store something, so to me the only acceptable option is the data to never leave my device.
So is this why on my laptop when I start a game after an update it starts "compiling vulkan shaders" for a few minutes? I've never understood what that was actually for but it takes 100% CPU on all cores so it's clearly doing something
Ratings aren't legally binding though are they? I bought games older rated than I was, and it's totally up to people's parents what they're allowed to play. Are you suggesting a 15 year old should be allowed to play the 16 rated game but not discuss it?
Does that outweigh the loss of privacy involved? I really don't think it does personally, I should not have to show anyone ID to have an Instagram account, privacy and anonymity is a feature not a bug.
For private individuals I think it probably is, not for public companies or especially governments though as they're supposed to accountable to other people.
I don't know about all heat pump systems, but mine at least requires the water tank to have a resistive immersion too. If the tank temperature gets below some threshold the heat pump refuses to work and turns the immersion on instead until it's warmed up enough.
I wonder if someone could make a foss frontend for Google Drive/Dropbox/<insert product here> that transparently encrypts files on your device before uploading them, that would certainly make me worry less about those services.
Interesting point, they'd have to either give a strict definition or a list otherwise I actually have no idea what to put. What about my ancient XDA Developers account that I don't even remember the username of? Would anyone with a Google account need to give that as YouTube exists?
Once you get it set up (which can be a pain) arch with KDE plasma is very good. KDE is very windows 10 like and intuitive. Arch gets rid of that issue of a mix of different installation methods, other than installing yay, I've never had to manually install something beyond "yay -S pkg", the aur and PKGBUILD files do really solve this issue of painful installations.
I've never worn one out but I've had to replace two after they got filled with sand (once from being dropped on the beach and once just from my pocket I think). No amount of cleaning would fix them, luckily with cheap Chinese phones one ebay search and €10 later I had a new charging port board.