Attacking Using Renegade-orphans
Okay, guys, I’ve been daily driving Arch for so long, I don’t even remember when I started. And that’s amazing, because it’s only about 2 years. I thought all was fine and dandy, but then I noticed, that my RAM usage just grows, for no reason. I need to periodically reboot to free the occupied memory. But I’m too jaded to rant about that. It really comes down to Firefox extensions (I suspect AdNauseam to eat most of the RAM, but hell, if it harms advertisers, rebooting every few days is a sacrifice I gladly offer) and just Chrome/Electron being retarded.
What prompted this rant, is AUR being used for phishing. This is the latest story, but it’s like third in a row. I’m not reporting on the story, I’m just venting, because this is stupid. Why do I use AUR? Because I want software that is there. But Jerry, you have to manually check the build script, to make sure it’s safe! No. That’s as much work as building it myself, that is unacceptable. And the outrageous thing is, that a lot of the software does have a Linux binary (such as Antigravity), but if you’re on Arch, you’re on your own. Anyway, let’s get some context. We’re gonna see here a transcript from DebConf 2014.
Q: Um, I guess we’re all, at least for me, I’m kind of wondering—very much like I think you are lately—how to get to the Year of the Linux Desktop, if you will, right? All right, and we’d all like it to be the year of the Debian desktop if possible. I’m trying to figure out if you have any insight as to possibly how to get closer or towards that, if anything.
Linus Torvalds: So I mean, there’s a lot of things that are getting closer to that. Technical people don’t tend to use Chromebooks, but I think Chromebooks are the kind of thing that will make the Year of the Desktop more possible, right? Because once people get used to running their applications basically as a browser, that makes a lot of things much easier.
That said, let me go on my first rant of the evening, right? One of the problems desktop has—I mean ignoring all the purely market stuff, getting pre-installs, and making it just so that normal people (and by normal people, I mean obviously non-technical people) will just buy a machine and it just works—one of the things that none of the distributions have ever gotten right is application packaging, right?
Now somebody will say, “Hey, dpkg is way improved and much better than RPM.” That’s not at all what I’m talking about. I’m talking about actual application writers that want to make a package of their application for Linux. I’ve seen this firsthand with the other project I’ve been involved with, which is my divelog application, right? We make binaries for Windows and OS X. We basically don’t make binaries for Linux. Why? Because making binaries for Linux desktop applications is a major fucking pain in the ass, right? You don’t make binaries for Linux; you make binaries for Fedora 19, Fedora 20, or maybe RHEL 5 from 10 years ago. You make binaries for Debian stable—well, actually you don’t make binaries for Debian stable because Debian stable has libraries that are so old that anything that was built in the last century doesn’t work, right? But you might make binaries available for Debian whatever-the-code-name-is for unstable.
Even that is a major pain because, Christ, we had this small local flame fest just a couple of days ago. Debian has these rules that you’re supposed to use shared libraries, right? If you don’t use shared libraries, getting your package in is just painful. But using shared libraries is not an option when the libraries are experimental, the libraries are used by two people, and one of them is crazy. So every other day some ABI breaks, right?
So you actually want to just compile one binary and have it work preferably forever, and preferably across all the Linux distributions. I actually think distributions have done a horribly, horribly bad job. One of the things that I do in the kernel—and I have to fight this every single release, and I think it’s sad—we have one rule in the kernel. There is one rule: we don’t break user space. Everything else is kind of a guideline. The whole security thing, it’s a guideline that we shouldn’t do stupid shit, right? But that’s not a hard rule; people do stupid shit all the time. I don’t get that upset. When people break user space, I get really, really angry. I mean, this is something that is religious for me: you do not break user space.
Even in the kernel, every single release I have people saying, “Okay, I’m changing this ABI because it’s cleaning stuff up,” and I’m like, “No, you’re not changing that ABI, because I will crush you,” right? And actually, it’s often okay to change ABI as long as nobody notices. But immediately when somebody notices, it’s a bad thing. This is like a big deal for the kernel, and I spend a lot of effort explaining to all the developers that this is a really, really important thing.
Then all the distributions come in and they screw it all up, because they break binary compatibility left and right. They update glibc and everything breaks. “Hey, you can recompile everything, right?” That really seems to be this mindset quite often. It’s like the glibc people say, “It was a bug! Look, here’s the standard, it says you can’t rely on that.” Nobody cares if it’s a bug—if people rely on it, it’s not a bug, it’s a feature, right?
I won’t even get into all the other libraries, but it’s really sad when the most core library in the whole system is okay with breaking stuff as long as things improve and they fix the ABI. So that’s my rant, and that’s what I really fundamentally think needs to change for Linux to work on the desktop: because you can’t have application writers do 15 billion different versions.
I’m on record as saying that maybe Valve will actually save the Linux desktop. It’s actually not because I think games are important. I don’t care, I don’t play games; I think some people do, so games may be important. But the really important issue is, I guarantee you Valve will not make 15 different binaries. I also guarantee you that every single desktop distribution will care about Valve binaries. So the problem is, Valve will build everything statically linked and create huge binaries. That’s kind of sad, but it’s what you have to do right now.
Fast forward 12 years and we still don’t have software distribution under control in Linux land! Like, how are people supposed to use the OS, if they don’t have the software? It’s a known problem and nobody cares. I already wrote two pieces about it (or even more). Nothing works and the few workarounds we have are being abused, so they’re unusable. Cheers.
So yeah, I thought that once I switch to Linux it will only get better over time, but it’s getting worse on multiple fronts. I’m not going to Windows 11 until I have to and I heard MacOS is also crap nowadays. IDK, maybe it’s time to switch to TempleOS. I mean, what other OS facilitates a connection with God? Who cares that TempleOS doesn’t have a network stack? When it comes down to it, you don’t need internet to lift code. Anyway, I hope I made my point and I’ll leave you with that.