• 19 Posts
  • 732 Comments
Joined 2 years ago
cake
Cake day: March 19th, 2024

help-circle
  • Most people who build software from source do it for reasons other than trust. Could be for fun (I imagine the main reason why people do Linux From Scratch), could be for the same reason that compels some people to use Gentoo lol. OP didn’t say what their motivation was.

    edit: nvm, in other comments OP has said they’re concerned about an xz style of backdoor. In any case, I would still be interested to read about someone trying what OP is suggesting.



  • My favourite unusual one is sichuan pepper powder on garlic bread. Originated in me rummaging through my spices for stuff to add to my garlic bread and I really liked this. I now add it to garlic bread, pizzas, that sort of thing.

    Cumin is also a great all purpose spice I put on many things. Cumin+turmeric for curry-flavoured things, but also cumin+salt+pepper+rosemary+garlic granules for anything roasted.









  • I don’t think any of those types of guns count as “non-violent”. None of the movements that have been the most effective have been strictly non-violent. You don’t have to be killing people at every action you do, but all the most effective movements have been willing to strategically use violence whenever the situation calls for it. Every strictly non-violent movement I’ve seen has simply been shooting themselves in the foot. When you’re shot at, shoot back, or you’re a coward obsessed with losing.








  • If you can’t feasibly vet the code yourself (I think it is feasible for things like scripts and other small projects) and the star count is low/it’s not already well known and trusted, probably try running in a VM first and look out for signs of it doing things it shouldn’t, e.g. if it’s sending HTTP requests to the internet despite it being a program that should be completely offline. Using things like AppArmor and SELinux to prevent programs from doing things they shouldn’t need to do is also good practice.

    Also, the tool itself may be low star count, but is the developer known at all? Someone with any kind of a reputation wouldn’t risk putting malware on their profile.

    I suppose you could also look at the list of dependencies of the program. Is it using any libraries that don’t make sense? e.g. with the above, is there some kind of HTTP request library being used for a program that shouldn’t need to access the internet at all?

    I think generally the risk is quite low as the author would be hiding their malware in plain sight if the source code is available. They’d have to bet on literally nobody checking. Which is fine for very obscure projects, but if you want your malware to spread, you want a good number of people to use it, at which point someone would presumably look at the code and notice it’s malware.