victorz comments on Signal AppImage now officially available for Linux

If you don't trust your distro packages, you should not use that distro. In my mind Arch Linux maintainers are way more trustworthy than a random guy maintaining the Flathub version.

permalink

fedilink

source

parent

hideshow 5 child comments

[–] victorz@lemmy.world 2 points 4 months ago

If you don't trust your distro packages, you should not use that distro.

Kind of my point. How high should my trust fence be before I can't install anything at all. 😅

permalink

fedilink

source

parent

[–] Vincent@feddit.nl 0 points 4 months ago (3 children)

Didn't Arch just have a major security issue due to their packages essentially being random guys too? (And I think the same thing could theoretically happen to most distributions?)

permalink

fedilink

source

parent

hideshow 3 child comments

[–] AcornTickler@sh.itjust.works 15 points 4 months ago (2 children)

No, that was AUR. Those were user-generated packages with nearly no vetting.

permalink

fedilink

source

parent

hideshow 2 child comments

[–] Vincent@feddit.nl 5 points 4 months ago

Ah gotcha, that is different indeed!

permalink

fedilink

source

parent

[–] AngryPancake@sh.itjust.works 5 points 4 months ago

To add to that, the wiki also makes it pretty clear users should be careful. It's nice to have for packages that aren't in the main repos, so it makes sense to have it somewhat part of the distro, but it does take manual effort to install aur packages, so in my mind, that's the best way to do it.

Big red label at the top: https://wiki.archlinux.org/title/Arch_User_Repository

Windows users are out there downloading random exe files...

permalink

fedilink

source

parent