Just a dorky trans woman on the internet.

My other presences on the fediverse:
@copygirl@fedi.anarchy.moe
@copygirl@vt.social

  • 30 Posts
  • 219 Comments
Joined 3 years ago
cake
Cake day: June 12th, 2023

help-circle

  • That makes sense, but what’s the alternative here? Linux is freedom, so that means freedom to run / install anything you want, including malware if you’re not careful. Maybe if you discourage people from using the AUR, they will install it through other means, like a developer-provided Flatpak or AppImage. But if that’s not available or doesn’t work, then it’s nothing (= sad user), or you’re back to “Google, then download an .exe the first thing you can run” or just curl | sh. Is that better? (Assuming we’re still talking about the kind of people who would skip vetting what they install.)



  • I keep hearing this claim online but the Arch bible (which you really should be familiar with if you use Arch) and pretty much everyone that knows anything will tell you that the AUR is useful, but not something to blindly use. I recommend everyone check the PKGBUILD, verify the source URLs are correct, and check the diffs when updating. It’s not that much effort.

    And since it comes from a single (user) package repository, you’ll probably have hundreds of people doing the same, or even going a step or two further and looking into the code, reporting the package if anything bad is going on. Still miles better than downloading .exe files you find from a Google search, even if you were lazy and didn’t do the aforementioned checks. (But if you don’t do that, you should probably just use Flatpaks or similar.)









  • My recommendations would be:

    • Do not rely on GC.Collect() in any real program code. Just let the GC do its thing.
    • If you need guarantees about when the destructor (or equivalent) is called, use the dispose pattern and use a using statement or declaration explicitly so Dispose gets called as soon as possible.
    class DestructorDemo : IDisposable
    {
        public string Name { get; set; }
        public DestructorDemo(string name)
        {
            Name = name;
            Console.WriteLine($"demo object {Name} constructed");
        }
        public void Dispose()
        {
            Console.WriteLine($"demo object {Name} disposed");
        }
    }
    
    using var obj1 = new DestructorDemo("obj1");
    
    using (var obj2 = new DestructorDemo("obj2"))
    {
        Console.WriteLine("Press key to dispose 'obj2'");
        Console.ReadKey();
        // obj2 goes out of scope at the end of the block
        // this will automatically call `.Dispose()` on it
    }
    
    Console.WriteLine("Press key to dispose 'obj1' and exit");
    Console.ReadKey();
    
    // obj1 goes out of scope here
    

    Note that this code is just to showcase the using keyword (in relation to IDisposable). If you want to implement the disposable pattern properly you should look at the help article I linked. Such as making sure that Dispose is called even if the object is naturally garbage collected, that is if you forget to use using. (I also didn’t check the validity of the code but it should get the idea across.)


  • I can understand that way of thinking, but

    • you’re at risk of becoming dependent, and not building the understanding you’ll need to make something that matters
    • many things start out as hobby projects that end up mattering after all

    Computers have become more complicated than when he learned to code and was “typing in programs from computer magazines.” Vibe coding, he said, is a great way for people to “get computers to do something that maybe they couldn’t do otherwise.”

    But the equivalent would be to take tutorials, examples and small open source projects and tinkering with them, rather than asking a machine to do it for you, no? I guess we’ll have to see how this affects young / beginner programmers going forward. I’d rather be careful than just hoping it all works out fine.



  • Selhosting and a vpn are optional depending on your use case; the app works with niether to help users try it out and get started. Like all secure messaging apps, its better to selfhost given the option.

    I’d say self-hosting is done for control over your data, not security. A typical end user will not know how to self-host, how to pick a privacy-respecting VPN, let alone secure their system. If your aim is to get to that same level of security, then I feel like the current direction is flawed, at least from what I took away from the readme.

    Or, in other words, “self-hosting is more secure given the option” sounds kind of like “writing your own software is more secure”.


  • This project is aiming to create the most secure and private chat app. It will heavily depend on how you use it. Here are some reccomended security optimizations/advice to keep your data secure and private:

    • Use a self-hosted instance of the app.
    • Use a VPN to protect your data from being intercepted.
    • Only connect to trusted peers.
    • Validate public key hashes.
    • You and your peer should use a secure device/os/browser with the latest updates.
    • use general security practices like not sharing sensitive information, not clicking on suspicious links, etc.

    These recommendations are bizarre.

    • Is it really P2P if you need to a host your own instance?
    • Use a VPN? So a company can now track you instead of the ISP?
    • If it’s aiming to be safe, then why not share sensitive information?

    If you want secure and private, then I would first look at Session.