cross-posted from: https://sh.itjust.works/post/62361303

Hello good people.

Is no one afraid of Bazzites auto updating nature?

I am myself worried about the potential for well timed supply chain attacks from wherever they build their OS images, which somehow build malicious images or just gets itself into the normal image builds and we auto update to.

Is this an unfounded worry? Does anyone know of the security measures in place to prevent attacks?

Auto update just feels weird to me, especially for something like my OS. I'm asking because I went and installed it and realised auto updating seems to be their philosophy... which is scary?

p.s. i couldnt find anyone online discussing this

Thonks

Hello good people.

Is no one afraid of Bazzites auto updating nature (in regard to privacy/malware)?

I am myself worried about the potential for well timed supply chain attacks from wherever they build their OS images, which somehow build malicious images or just gets itself into the normal image builds and we auto update to.

Is this an unfounded worry? Does anyone know of the security measures in place to prevent attacks?

Auto update just feels weird to me, especially for something like my OS. I'm asking because I went and installed it and realised auto updating seems to be their philosophy... which is scary?

p.s. i couldnt find anyone online discussing this

Thonks

Just to be clear: I'm not asking for github alternatives.

If you had an open source project that is somewhat deeply rooted in GitHub's ecosystem and wanted to move to another service, how would you proceed?

I'd really want to self host a service, but then i'd be subjecting my internet to regular clones or downloads of releases (I'm not sure how much that'd effect me generally, but it seems worth considering).

No one's internet is as reliable as a cloud hosted service either, so there's also that to consider.

So I guess a cloud option? (Codeberg probably btw)

But then (either way) you're potentially splitting a community I'd imagine?

You can mirror repos to github, but if you have a project small enough and it forces issues/prs on another service, is anyone gonna bother?

Maybe you just have to swap and be okay with less people around, just so you can get out of Microsoft's grip in open source.

Do you have any thoughts?

No one's posting anything for me to read so..

I just got hyprland the other day, still getting everything setup so that I have a full desktop environment, but so far I am enjoying the process of picking and choosing each element.

Hyprland itself is great, but it really opened my eyes to wayland and how great the ecosystem is with stuff like Waybar, tofi and all the other tools.

I considered omarchy, but you have to install that like an OS, which sucks, so I ended up just installing hyprland (and the other stuff) manually, and I'm glad I did. Doing it manually forced me to learn how all the bits fit together, which I thought would be boring, thankfully it wasn't.

All of that and then before posting this I read this communities sidebar: "we don't agree with vaxry". Looked up "vaxry drama" just to now find out that they are encouraging and engaging in their own toxic community and stuff... if I knew that before, I probably wouldn't have gone down the rabbit hole that is hyprland and building your own DE like lego, mostly because: can you trust someone like that and feel good about running their code on your system?

I'm coming from being a KDE Plasma enjoyer for the past half-decade, and I have never heard any drama from their side so coming here and seeing that is kinda shocking, though I guess that's what you get when you have one core person building the software (who is still young themselves).

I think I'm going to stick with hyprland for now because looking back, KDE Plasma seems like a janky & slow mess in comparison to what I have now.

Still feels like a shame that good software is tainted by this type of behavior, I hope they and their community is getting better, but I'm not super up-to-date on the whole fiasco (just finished reading some old blog posts on it, nothing new, so maybe they have become better idk yet).

I know linux itself can have some toxic traits in the community, but usually that's just people being very forward in their communications. Nothing homophobic as far as I know..

You have any thoughts?

Bye