Conversation

Notices

1. Embed this notice
   Wolf480pl (wolf480pl@mstdn.io)'s status on Tuesday, 09-Jan-2024 03:47:30 JST Wolf480pl

   I've said this before but

   Software freedom is not when the source code for the program you use is somewhere on github, has 5000 dependencies and doesn't build outside of CI

   Software freedom is when you have the source on your computer, modify it, build it, and run a modified version

   How much of the software you use on a daily basis would you be able to build from source? How many urls does that require fetching, and how many of these can stop working any time without prior notice?
   1/

   • Haelwenn /элвэн/ :triskell: and Alexandre Oliva like this.
   • Embed this notice
     gentoobro (gentoobro@shitpost.cloud)'s status on Saturday, 27-Jul-2024 06:40:34 JST gentoobro

     in reply to

     There are far too many needless dependencies these days. I swear, people have become allergic to actually writing code. It's especially bad in languages with standard or semi-standard package managers. Is a simple wrapper arounf print() too hard for you? Gotta pull in a "logging library" that itself has a few dozen deps. Fucking pad a string? npm install lpad.

     The needless deps make everything brittle.

     ✙ dcc :pedomustdie: :phear_slackware: likes this.
   • Embed this notice
     Wolf480pl (wolf480pl@mstdn.io)'s status on Wednesday, 16-Oct-2024 02:51:04 JST Wolf480pl

     in reply to

     I remember my dad's RedHat came on 4 CDs: 2 Binary Discs, one Source Disc and one Documentation Disc.

     If it worked the way I think, you could take it to a desert island and rebuild everything from source, with just those 4 CDs and an x86 computer.

     Today a Debian mirror has 100+ GB of source packages and 600+ GB of binaries just for amd64.

     But at least it's one place, heavily replicated. And IIRC it's supposed to work on a desert island.

     2/

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Wednesday, 16-Oct-2024 02:58:48 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • nytpu
     • LisPi
     @wolf480pl @lispi314 @nytpu Gentoo is still prepared for an internet-apocalypse. In fact I ended up discovering some weeks ago that the dev-util/yacc package could easily mean having the last easily available copy (short of hunting for source CD/tapes/…) of what seems to be the original yacc.
   • Embed this notice
     Wolf480pl (wolf480pl@mstdn.io)'s status on Wednesday, 16-Oct-2024 02:58:49 JST Wolf480pl

     in reply to

     • nytpu
     • LisPi

     @lispi314 @nytpu I think another way to become resilient against link rot is to have all the source code of the packages you use in one place.

     There used to be source CDs but most distros don't fit on a CD or a DVD anymore. So either mirrors like Debian does, or keeping the source code of everything you install on your local disk (or a NAS).

     A while ago I was of the opinion that Gentoo users are uniquely well prepared for an apocalypse, but that may've changed recently

   • Embed this notice
     LisPi (lispi314@udongein.xyz)'s status on Wednesday, 16-Oct-2024 02:58:50 JST LisPi

     in reply to

     • nytpu
     @wolf480pl @nytpu That last one is one reason why Guix's work on alternate download sources is quite important, I think.
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Wednesday, 16-Oct-2024 03:18:40 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Haelwenn /элвэн/ :triskell:
     • nytpu
     • LisPi
     @wolf480pl @lispi314 @nytpu And one thing I quite like with Gentoo is not having to deal with build-essentials or -dev packages, all you need is the stage3 as a binary seed, portage tree (git repo also available as tarball snapshots) and then it's upstream tarballs.
     And given the recipes+patches are all in one place, even if Gentoo would get compromised somehow, you could still recover. While Debian… ouch.
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Wednesday, 16-Oct-2024 03:30:40 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • nytpu
     • LisPi

     @wolf480pl @nytpu @lispi314 That or "woups, backups weren't made properly and we lost part of our infra".
     A rogue debian developer would mean at least few lost packages as I doubt most debian developers have enough of a local copy to recover the whole distro.

   • Embed this notice
     Wolf480pl (wolf480pl@mstdn.io)'s status on Wednesday, 16-Oct-2024 03:30:41 JST Wolf480pl

     in reply to

     • Haelwenn /элвэн/ :triskell:
     • nytpu
     • LisPi

     @lanodan @nytpu @lispi314
     (assuming by compromise you mean "someone tried to put a backdoor in the source packages")

   • Embed this notice
     Wolf480pl (wolf480pl@mstdn.io)'s status on Wednesday, 16-Oct-2024 03:30:42 JST Wolf480pl

     in reply to

     • Haelwenn /элвэн/ :triskell:
     • nytpu
     • LisPi

     @lanodan @nytpu @lispi314
     IIRC (some?) Debian source packages use an upstream source tarball + -debian tarball (containing the debian/ directory, including patches and buildscripts) that gets extracted on top of it, and then patches get applied.

     It's not as clean as I would like, but in principle the stuff authored by Debian is separate from upstream code.

     You just need pre-compromise build-essential, upsteram tarballs, and audited *-debian tarballs.

   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Wednesday, 16-Oct-2024 03:33:57 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Haelwenn /элвэн/ :triskell:
     • nytpu
     • LisPi
     @wolf480pl @lispi314 @nytpu Which also incidentally means that one doesn't simply forks Debian.
   • Embed this notice
     Wolf480pl (wolf480pl@mstdn.io)'s status on Wednesday, 16-Oct-2024 03:49:16 JST Wolf480pl

     in reply to

     • Haelwenn /элвэн/ :triskell:
     • nytpu
     • LisPi

     @lanodan @nytpu @lispi314
     yeah, you typically become a debian downstream instead of forking it

   • Embed this notice
     Wolf480pl (wolf480pl@mstdn.io)'s status on Wednesday, 16-Oct-2024 03:49:16 JST Wolf480pl

     in reply to

     • Haelwenn /элвэн/ :triskell:
     • nytpu
     • LisPi

     @lanodan @nytpu @lispi314
     also being a debian downstream distro is one of the sanest ways of doing infrastructure-as-code with Debian

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Wednesday, 16-Oct-2024 05:43:33 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • nytpu
     • LisPi
     @lispi314 @wolf480pl @nytpu Well neither do current AAA video games either, so fair enough if the much more useful thing that is a full distro mirror takes something like a few hundred gigs.
     
     And I think the best you can currently get on Debian side is a mirror of what's basically ftpmaster@ uploads rather than source repos?
   • Embed this notice
     LisPi (lispi314@udongein.xyz)'s status on Wednesday, 16-Oct-2024 05:43:34 JST LisPi

     in reply to

     • Haelwenn /элвэн/ :triskell:
     • nytpu
     @wolf480pl @nytpu @lanodan There are a few packages for repository mirroring.
     
     It definitely doesn't fit on anything except BD-XL discs.
   • Embed this notice
     Wolf480pl (wolf480pl@mstdn.io)'s status on Wednesday, 16-Oct-2024 05:43:35 JST Wolf480pl

     in reply to

     • Haelwenn /элвэн/ :triskell:
     • nytpu
     • LisPi

     @lanodan @nytpu @lispi314
     oh, in the sense that it's not a single git repo everyone has - yes, that would be a problem.

     I wish they were still doing source CDs :/