10 of the Most Unhealthy Fast-Food Restaurants in the US [via WorldAtlas]
What was your guess for number 1?
worldatlas.com/society/10-of-t…
10 of the Most Unhealthy Fast-Food Restaurants in the US
Popular fast food chains serve high-calorie meals loaded with salt, sugar, and fat, encouraging unhealthy eating habits nationwide.Nour Berjawi (WorldAtlas)
Tundra
in reply to Xylight • • •Mwa
in reply to Tundra • • •Mwa
in reply to Xylight • • •Voytrekk
in reply to Mwa • • •pyssla
in reply to Voytrekk • • •Sorry, but I fail to see this.
I suppose if you're accounting literally all independent distros, then you're probably right. However, if we'd be more realistic and compare it to other well-established independent distros^[I'm basically counting Alpine, Debian, Fedora, Gentoo, openSUSE, Slackware, Solus and Void. I didn't count Guix System and NixOS for how their 'repositories' are built different and therefore not easily comparable to the others.], then we notice that the vastness of the packages found in Arch's repository is rather lackluster at the very least. Heck, by virtually all metrics, Arch together with its derivatives undoubtedly belong in the upper echelons of usage stats; only being second to the Debian-family of distros. IMO, however, the size of its repository absolutely doesn't reflect this; as it's only bigger than Slackware, Solus and Void. The inclusion of these smaller projects is arguably charitable on my side*. But to drive the point home very clearly: Arch's repository is smaller than Alpine's, Debian's, Fedora's, openSUSE's and Gentoo's with a ratio of (about) two to one (except for openSUSE).
DistroWatch.com: Put the fun back into computing. Use Linux, BSD.
distrowatch.comVoytrekk
in reply to pyssla • • •I don't know if raw package counts is the best comparison. Unlike say Fedora, Arch bundles everything related to a project in the same file. If you want Qt6-base on Arch, that is one package. If you want it on Fedora, it is going to have a lib, header, docs, and maybe a few other packages.
Just from personal experience, I do not have issues with finding packages in the main repos, with only a handful of my packages coming from the AUR. This is not the case with others, like Fedora where extra repos need to be added, like EPEL and RPM Fusion.
pyssla
in reply to Voytrekk • • •Thank you for the quick response!
You're probably right. Do you think we got anything better to go by?
Can't comment on this. Though, the list of packages with qt6 in their name is considerably longer in Fedora. However, I wonder if this simply reflects that Fedora, by virtue of having a larger repository, also has more stuff related to qt6. Or, as you posited it, chooses to package the same content over multiple packages instead of bundling them like it's supposedly happening on Arch.
Hmm..., I feel you might be conflating stuff. Please allow me to elaborate on what I mean.
Fedora is not able to include some packages in its own repository due to legal reasons. As such, these are relayed to RPM Fusion instead. Which means that a well-functioning Fedora installation (almost necessarily) desires to install some packages from RPM Fusion. So, RPM Fusion exists as a 'hack' of sorts to protect Fedora from legal charges and NOT because they're too lazy (or something) to ship those packages themselves. To be clear, RPM Fusion is accepted as a trusted third-party repository.
Arch, on the other hand, is rather lenient on what they can include in their repositories. Basically enabling them to package within their repositories all codecs and whatnot without them being visibly worried about the legal consequences of this ordeal.
To be honest, I don't know exactly where this discrepancy comes from. But I wouldn't be surprised if it's related to how Arch is basically a genuine community distro while Fedora has official ties to Red Hat.
Btw, small correction, AFAIK you're not supposed to install packages from the EPEL on Fedora. Perhaps you meant COPR (basically Fedora's AUR) or Terra instead?
Getting started with EPEL
Fedora DocsMwa
in reply to Voytrekk • • •facow [he/him, any]
in reply to Mwa • • •hobbsc
in reply to Xylight • • •lagoon8622
in reply to hobbsc • • •hobbsc
in reply to lagoon8622 • • •lagoon8622
in reply to hobbsc • • •balsoft
in reply to hobbsc • • •Ulrich
in reply to Xylight • • •So...did someone just like create a new package cloning these or did they somehow get into the "official" repository? Is there no attestation process?
Jolteon
in reply to Xylight • • •MentalEdge
in reply to Jolteon • • •Absolutely.
The Arch User Repository is a way for anyone to easily distribite software.
Hence it has never been secure, and rather than claim it is, you mostly see people and documentation warn you about this, and to be careful if using it.
Any schmuck can make whatever they want available via the AUR. That's how even the tiniest niche project can often be installed via the AUR. But you trade in some security for that convenience.
HaraldvonBlauzahn
in reply to Xylight • • •What a nice attack on privacy-friendly infrastructure.
And then, Arch AUR has such suspicious things like the Brave browser which claims to reduce tracking.... and works together with advertisers.
To be clear, AUR is fantastic if you develop some experimental package and you want to give it to your friends to try it out easily. But not as a general distribution mechanism.
HaraldvonBlauzahn
in reply to Xylight • • •curl | bash
install procedure and relying on TLS certificates which are e.g. issued by the Russian government. (No, the rust project won't use a Russian/Chinese/US Gov certificate but your browser will trust near all of them...)Ephera
in reply to HaraldvonBlauzahn • • •HaraldvonBlauzahn
in reply to Ephera • • •wewbull
in reply to HaraldvonBlauzahn • • •Ephera
in reply to HaraldvonBlauzahn • • •Sure, I guess, if you've got a distro installed on your PC and use the distro-provided packages to install the Rust compiler, then you can't be subject to such certificate MitM attacks.
Your comment sounded like you were primarily concerned about the shell script piping rather it just being a program which can be downloaded without going through distro packages.
HaraldvonBlauzahn
in reply to Ephera • • •The AUR install scripts are just downloaded shell scripts which are executed (hopefully after inspection).
curl | bash
just skips the inspection step - curl downloads to stdout, bash executes from stdin.muusemuuse
in reply to Xylight • • •We are getting to the point where inviting more people in means we will need an automated babysitter to watch for this shit and to pull it once it’s discovered. Apple has a walled garden approach that’s certainly taken a big chunk of malware threats out of their devices but their walled garden approach is ridiculous and impractical for Linux. The Microsoft method of monitoring and second guessing everything with antimalware programs is also suspect because it is super easy to abuse and resource intensive. We have clamAV but clam kinda sucks.
Linux is at the point where we need something that audits what’s going in and automatically yanks it back out remotely if it’s found to be a problem. Things can only be added by the user, but the bot can remove them without interaction of the user.
I don’t see this happening though. Instead, I see this as more of a rust vs C thing all over again, where valid critiques are drowned out by “improve your skills bro.”
oo1
in reply to Xylight • • •I already assumed aur was riddled with stuff like that.
Use a condom when fucking around in there.
AceFuzzLord
in reply to Xylight • • •Gotta assume that if any Arch users actually fell for that one, that they either let their kids use their device or they're generally not smart ( which absolutely goes against my stereotypical view of an arch user ).
pfr
in reply to AceFuzzLord • • •moseschrute
in reply to pfr • • •I had no idea that existed but I’ve just returned from r/unixporn. There are some sick setups. Also we all copy. My entire neovim config is copied and modified from a couple dozen setups I admired. Nothing wrong with copying things you like. Don’t gate keep Linux.
However… Minecraft cracked is pretty funny lol.
lattrommi
in reply to moseschrute • • •I agree that gatekeeping is no good and people should not do that.
However...
I do not feel that assuming all people copy, should be done either, in my opinion.
pfr
in reply to lattrommi • • •lattrommi
in reply to pfr • • •I don't know if there is a word for what I was trying to point out.
Like an opposite to gatekeeping, sort of.
I do not like when people use 'we', in ways that include people that it does not apply to. Lumping everyone together inaccurately into a group.
teawrecks
in reply to Xylight • • •redxef
in reply to Xylight • • •With
vulnerable_packages.txt
containing one package name per line.Matt
in reply to Xylight • • •TLauncher — Download Minecraft Launcher
TLauncher