BUSTING some packaging format MYTHS! App verification, sandbox, package maintainers...


Head to squarespace.com/thelinuxexperi… to save 10% off your first purchase of a website or domain using code thelinuxexperiment

Grab a brand new laptop or desktop running Linux: tuxedocomputers.com/en#

👏 SUPPORT THE CHANNEL:
Get access to:
- a Daily Linux News show
- a weekly patroncast for more personal thoughts
- polls on the next topics I cover,
- your name in the credits

YouTube: youtube.com/@thelinuxexp/join
Patreon: patreon.com/thelinuxexperiment

Or, you can donate whatever you want:
paypal.me/thelinuxexp
Liberapay: liberapay.com/TheLinuxExperime…

👕 GET TLE MERCH
Support the channel AND get cool new gear: the-linux-experiment.creator-s…

🎙️ LINUX AND OPEN SOURCE NEWS PODCAST:
Listen to the latest Linux and open source news, with more in depth coverage, and ad-free! podcast.thelinuxexp.com

🏆 FOLLOW ME ELSEWHERE:
Website: thelinuxexp.com
Mastodon: mastodon.social/web/@thelinuxE…
Pixelfed: pixelfed.social/TLENick
PeerTube: tilvids.com/c/thelinuxexperime…
Discord: discord.gg/mdnHftjkja

Timecodes:
0:00 Intro
0:41 Sponsor: SquareSpace
01:45 App Verification and security
04:36 Distro packages aren't really safer
06:46 Sandboxing: no silver bullet
09:07 Distro dependencies are better?
13:07 It's your responsibility to check
14:50 Sponsor: Tuxedo Computers
15:43 Support the channel

Verified apps are an implicit guarantee that this thing is as the developer intended. What app verification isn't, is a guarantee that the package you're downloading is safe, or has no security problems.

If the repo has been hacked, if one of the maintainers for the app is malicious, then the official package will also contain that code.

The security argument will often be used to push people towards distro packages instead of flatpaks and snaps, but this is also not really how things work.

The general view of distro packages is that they can be safer, because there's a trusted maintainer that will create the package, and thus can detect any unwanted change, backdoor, or problem, and prevent you from getting the infected or buggy version of the package.
This is not really the case though.

Log4J, the recent SSH vulnerability, the XZ backdoor, and basically every CVE ever discovered points to the fact that maintainers DO NOT do security reviews on most packages they build. That's not what is expected of them either. A lot of maintainers aren't developers and couldn't conduct these audits in the first place.

unixdigest.com/articles/how-se…

flameeyes.blog/2022/02/15/on-t…

Another big misconception is around the sandbox for Flatpaks and snaps. A sandbox basically just means that the app you're running has a system of permissions that limits what the app can do, and how it can interact with the system. It CAN be more secure than not having a sandbox, but it doesn't mean it IS always more secure.

Another example of the sandbox not doing anything to protect the user is with the recent scam crypto apps on the snap store: these WERE sandboxed, because they scammed you through a web view, a website basically.

Another common misconception around packages is how dependencies work. You'll often read that distro packages use the system dependencies, and thus use less disk space, and are more secure, because you know that the library the app relies upon is updated by your distro, compared to a flatpak, snap or AppImage, where the dev might have bundled a dependency on their own, and never bothered to update it.

First, you CAN check which versions of dependencies the package comes with. A flatpak is open, you can see how it's built. Second, distro packages aren't always up to date either: just because it's a shared library doesn't mean it has all the latest security fixes.

This example will be clearer: MariaDB got a security update in 2021 in November. While Arch and Artix updated things the same day, Debian took 3 months to apply it, and Alpine took 4. Same goes for fixed linux kernel versions: when your distro is locked to a specific kernel version, it's been factually proven that this version becomes more and more buggy and vulnerable over time, as maintainers simply don't apply every fix, and don't backport everything. For example, the current RHEL 8.8 kernel had more then 4500 bugs open that have fixes in later kernel releases.

unixdigest.com/articles/how-se…

ciq.com/blog/new-research-the-…

debian.org/devel/wnpp/orphaned…

This entry was edited (2 weeks ago)

Gazans watch Israel’s war on Iran with a mix of hope, skepticism, and frustration #Palestine mondoweiss.net/2025/06/gazans-…

"NO WAR WITH IRAN: US veteran Josephine Guilbeau bravely calls on active duty members to push back against war with Iran and expresses how this war is for ..."

Ça sonne québecois, Guilbeau... (trouvé ça sur FB)

#Iran #ForEverWars

This entry was edited (1 month ago)

reshared this

Don't know if this is legit, but if it is, it will come out sooner or later so I'm not going to try to figure it out. Just thought it was interesting. If it is real, it's a bombshell, but with AI voice mimicry you just never know.

EXCLUSIVE: Virginia Giuffre’s ‘Deadman’s Switch’ Released: “I Have Been Murdered - This is the REAL Epstein List”
x.com/PastorBobJ11071/status/1…

1,000 Fenway Park Concessions Workers May Strike For First Time in 113 Years working-mass.com/2025/06/18/10…

How A Mass. Special Commission Became a Trojan Horse Against the Powerful Statewide Educators Union working-mass.com/2025/06/18/ho…

Not a criminal? A fighter for Democracy in Hong Kong? Holder of a Master's Degree? Legally and faithfully following the asylum process?

Doesn't matter. No one - not Chao Zhou, not even citizens - are safe from Trump's masked Gestapo, just filling up the boxcars any way they can to meet Stephen Miller's quotas.
blockclubchicago.org/2025/06/1…

A new kind of war has just been normalised through global responses to Israeli aggression: threshold war, in which nuclear states conduct wars of aggression against almost-nuclear opponents out of fear that the latter will obtain weapons that reshape geopolitical power balances, while the potential targets of such aggression are incentivised to rush towards acquiring these weapons to avoid the very threat of such aggressive actions.

Also being normalised: attacks on nuclear facilities.

theconversation.com/iran-israe…

reshared this

Broad Lebanese solidarity with Iran against the US-led Israeli aggression tehrantimes.com/news/514623/Br…

i am so embarrassed that i didn't know tons of our corporations got #reparations from #iraq no joke, at the 10-minute mark. but the whole video is good even though you've probably already the 1,000,000 reasons why this premise of this war is absurd.

doubledown.news/watch/2025/jun…

#iran #iranisraelwar

Nanook reshared this.

Farmers suffer heavy losses in Jordan Valley and northern West Bank due to blockade, crossing closures middleeastmonitor.com/20250618…

The immigrant from El Salvador, who built a mass following on social media through his work documenting ICE raids, will now have to fight in immigration court for his right to remain in the country and ward off deportation.

amren.com/news/2025/06/hispani…

If all of the third world died tomorrow, (a) nothing would be worse and (b) no one would notice.

A former National Intelligence Officer for Cyber under President Trump and Joe Biden has come forward with explosive allegations: the CIA and Office of the Director of National Intelligence (ODNI) deliberately buried evidence of Chinese Communist Party (CCP) interference in the 2020 presidential election—and fired him when he refused to play along.
thegatewaypundit.com/2025/06/f…

Dr. Murakami: We found that as the number of doses increases, the peak of deaths appears faster, meaning the more doses you get, the sooner you’re likely to die, within a shorter period. So, the risk increases with more doses. If the vaccine had no toxicity or didn’t induce death, there wouldn’t be a peak. That’s the point.
thegatewaypundit.com/2025/06/j…

Israel Censors Zionists' Death Toll Amid Heavy Iranian Missile Strikes tn.ai/3337549

La IA como compañera y herramienta de programación


Llevo unas semanas usando la IA como herramienta de programación en mis proyectos, he aprendido a manejar los agentes de IA que son un paso más en la evolución de la inteligencia artificial; parecidos al agente Smith de Matrix, los agentes son modelos de IA que pueden tomar decisiones por ellos mismos, evaluar resultados y actuar en consecuencia, llegando incluso a autocorregirse.

Con ayuda de los agentes se pueden crear proyectos de software desde cero con unas simples órdenes, basándonos en un código con buenas prácticas y/o seguridad. Algo a lo que creo que ningún programador llegará por muchos años de experiencia que tenga. El discurso negacionista de la IA se irá diluyendo conforme se adapten los trabajos a esta herramienta, o se corre el riesgo de ser un parado digital más.

Hoy han cambiado las políticas de uso de GitHub Copilot, y ya no será ilimitado como hasta ahora, todo lo bueno se acaba. Mientras tanto me ha dado tiempo a refactorizar proyectos, crear temas y plugins de wordpress, empezar nuevos proyectos como ringnet.cloud o comenzar a implementar un kernel desde cero en rust basado en Linux. Las posibilidades son infinitas si esta herramienta sabe usarse correctamente, no solo ahorrará trabajo sino que lo potenciará con una alta calidad y eso depende de nosotros. Saludos 👋

Two hundred and fifty years after the American Revolution began, we are again at war, and Los Angeles is ground zero. Thugs waving the Mexican flag is not just a case of ethnic Mexicans expressing pride at being Mexicans. It is a declaration of war — physical and metaphysical — against our country and everything she is and stands for.
thefederalist.com/2025/06/18/l…

i switched mobile carriers and the new one has a voice AI assistant. the voice AI was actually better than the human pajeet i talked to. the jeet was completely bullshitting me and just talking out their ass, had no idea how to configure the access point manually for their mobile service and just basically pretended to do some technical bull crap on their end, put me on hold a few times, then didn't solve my problem

the AI at least got me pointed in the right direction, even though it gave me bad info.

eventually i figured it out from their web docs.

in reply to woodland creature

i kept my last phone until i was absolutely forced to buy a new one due to obsolete radio frequencies that nobody supported anymore. the phone itself was still working fine, just network changes made it obsolete. kind of unfortunate. i like my current phone too and don't want to be forced to buy a new enshittified one with no headphone jack
This entry was edited (1 month ago)
in reply to dandelion

didn't i just see any new sandman season announced though?

I feel like we have to be able to separate artists' bad behavior from our evaluation of the quality of their work.

Maybe there's a time limit? Maybe they have to be dead so they can't benefit from their work being sold.

Are there any non problematic artists/creators from 500 years ago who we nevertheless find their work product valuable to society today? What about science? Especially medicine with all the body snatching.

Neil Gaiman is almost certainly a sex pest based on all the women reporting. So I get not wanting to give him money. He hopefully gets it, too.

I like the suggestion of piracy as an approach...

I genuinely do not understand people who have deep fried opinions about Signal needing a goddamn phone number in 2025.

Many privacy nerds were outraged when you needed to give out a phone number to other people in order to talk with them. I was one of those nerds. They fixed that with the usernames rollout.

As a mobile phone app, Signal uses your phone number to bootstrap your enrollment into the protocol. This is literally the path of least resistance as an SMS replacement app, for most users.

If you want to know whether Signal can obtain enough metadata to target users that have enrolled, the answer is complicated.

The way profiles are encrypted, and how sealed sender works, makes any targeting seem infeasible. (Your profile key rotates, at mininum, when you block someone.)

Signal currently does not have IP addresses, etc. stored. If this changes in the future, it will not be retroactive. If you're worried about that, Molly boasts Tor support. Maybe that's fine. I haven't audited Molly, and won't.

This entry was edited (1 month ago)

I'm on the side of the Iranians, I always side with anyone that goes up against Israel, even if it means Americans are going to get killed.
I don't care anymore about stupid brainwashed American morons, they have the internet in front of them, 24/7 and chose to look at porn and play video games instead of educating themselves. They deserve to die in the Middle Eastern meatgrinder.

x.com/RT_com/status/1935417323…

Last week's assassination of Minnesota's Democrat former House Speaker was the logical sequel to that of the United Healthcare CEO


Those who cheered on the latter murder should now be examining their consciences.

The historical record is very clear: in politics, violence begets violence. This story is only beginning and it may not end well for America.

See details about the recent shootings.

Chinese Foreign Minister meets his counterparts from South Africa, Burkina Faso, Niger, Guinea-Bissau and other African countries socialistchina.org/2025/06/18/…

On top of all the barbarism that #Israel is engaging in in #Gaza and now in #Iran, here's some news that you don't hear about:

english.palinfo.com/news/2025/…

"Israeli occupation forces (#IOF) demolished multiple residential buildings on Tuesday in the Syrian town of Al-Hamidiyah, located in the northern countryside of #Quneitra near the occupied Golan Heights."

The fault of the residents is that their homes are close to a newly established military base.

#Syria

benda reshared this.

Palestine Action forces permanent closure of Elbit Systems lobby firm #Palestine palestineaction.org/eagle-cons…