I mean, if firefox didn’t kneecap themselves every so often then probably people would also optimize for firefox. One example, WebUSB. I can configure my keyboard from a website. No need to install any 3rd party native app. On chrome, you have webserial on Android even. So I do have PWA that I can use to read sensor over serial via OTG. Not only that, chrome also support PWA install even on desktop. Firefox removed PWA ability to be installed on the desktop. That’s why technically electron is not needed if companies aren’t so greedy to spy on your pc using more invasive method. Just ship the html, css, assets and js then let the browser be the sandbox. No need to ship the browser itself.

That’s not how story writing works. Or any long form written art works for that matter. Try to ask any writer if they ever “write in their head” and publish those as a book as-is

Damn, what’s the movie name again? With Tom Cruise cloned and all?

Edit: It was oblivion

Every *-git package also fetch it from the repo. The apt analogy is someone haven’t been maintaining the nixpkg and then it gets adopted by someone else. Now that someone else change the build script to be malware. So it is no fault of the upstream

I know where you’re coming from when you say they are different. But I disagree on that because at the end of the day you’re still trusting other people would not act maliciously or get their account compromised. The selection process doesn’t make it any more special as demonstrated by xz in my example.

Anyone can be an AUR submitter and maintainer. Act in good faith and never become an Arch maintainer. Someone can be an Arch maintainer and be good for a few years then something happened and their account got hacked or bad blood made them act rashly.

That’s precisely what I mean when I equate AUR maintainer to the distro maintainer. To the package management system, they are both trusted. Not in the sense of how special they are or how strongly you can trust one but not the other.

Yes, and that is no different than distro maintainer that maintains the infrastructure and package. Anyone can volunteer. That’s how xz is compromised. The point is that aurto trust models mimic those of other package managers. Trusting the authors implicitly trust the code. The only other special things from distro maintainer is their PGP signatures are required to perform release on the main repo. This is better because as I stated earlier, reviewing PKGBUILDS would encourage people to just skip it. Not everyone has the time for that. But when a maintainer changes? Aurto removes the package for you to perform that first trust again on the new maintainer. This is no different than if you update the arch keyring just more manual

Well, it is just like a distro maintainer account anyway. If the maintainer account is compromised then gg for the whole distro. That’s what happens with other supply chain attacks as well and yes, I do think we need a way to fix that without compromising on ease of usability

Yeah, use and promote aurto instead. They require you to trust the maintainer and would remove the package from the local repo if the maintainer is changed

Yeah, honestly we should have a way to instrument JS without actually making the JS runtime able to read the measurement data

There are areas that can be improved to reduce waste tho. Providing e-reader for example instead of a full blown tablet to reduce book waste is I think would help. Plus students don’t have to lug around their textbook AND workbook at the same time. Like legit, tech can be helpful IF they are implemented TO ACTUALLY HELP and not to sell something