u/turbofish_pk

▲ 29 r/rust

Dependencies and supply chain risk

Recently Mitchell Hashimoto posted on X the below text, which I find very interesting and correct, but I also remember how harsh the comments were for sudo-rs and it's no dependencies policy.

Anyways, I am posting it here as food for thought.

> Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).

> If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!

> I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it.

> Feeling pretty swell about this mentality with all the supply chain attacks happening.

reddit.com
u/turbofish_pk — 14 hours ago
▲ 3 r/Fedora

Discord Client Installation

I use discord only for chatting and I occasionally post screenshots. No games, video or voice. I am considering installing it locally on my Fedora 43 KDE, because my browser (chrome) becomes a mess of open tabs and is also a resource hog.

I have two questions.

  • Does it make sense to install it locally as separate app? Do you have personal experience that could help?
  • Given that sudo dnf install discord and sudo dnf install Discord do not work, what would be the best way to install it? Use the .rpm from the site?

Thanks a lot in advance.

reddit.com
u/turbofish_pk — 4 days ago

Authoritative or official Odin Community

Hello friends,

so far I see three different sites of communities and it looks a bit fragmented.

Which one is the official or central community?

Thanks in advance

reddit.com
u/turbofish_pk — 8 days ago

GNU Autotools

Do you use GNU Autotools (configure.ac, configure, make) to maintain and build existing or new projects? I can't find reliable information if they are still used outside some GNU related projects like the Emacs. My question is if you personally use them or if you know other that use them currently. Thanks in advance.

reddit.com
u/turbofish_pk — 15 days ago

What are the principles of suckless? Can it be used for Linux development? Are there any important projects? Are there any specific programming languages favored? Thanks in advance.

reddit.com
u/turbofish_pk — 30 days ago