no need to troll here.

And fascinating how predictibly this happens each time the interests of big tech companies are touched…

Are you disputing that much of tech is addictive by design?

You still can get cheap dump phones.

Regarding do this device:

1. Manufacturing a phone in small numbers is not cheap
2. If there were a way that you could have 50% more attention for your kids, yourself, and the people around you, how much would that be worth for you? How much is your attention worth?

I see job ads for using that for doctor’s diagnostic notes.

Guix is a smaller distro with (presumably) less maintainers […]

Guix is not a small distro any more and has a lot of support. Yes it has more packages than Arch - but this is hardly an argument against it. It is built on different principles compared to the Arch user repository - keeping control of the own computer was always a core goal of GNU, and this logically includes security from malware.

Yes, Guix is initially a clone of Nix and has still remains of shared code (the build daemon).

Differences:

• Guix packages are defined in a Scheme dialect called Guile, a nice minimal functional language
• Guix was created as a GNU project and stresses the importance of free software with strong copyleft
• strong focus on long-term reproducibility and capability of tracking the sources
• everything is built from source
• very good and well organized documentation

Guix packages are vetted.

AUR packages aren’t.

And, package definitions in Guix are not shell scripts but highly abstracted functional installers that use the respective build tools of software packages. This makes them much easier to review - and quicker to write, in many cases.

Guix is also fully reproducible, and has the goal to provide safe distributely built software. (It gets significant hate from tech companies for requiring GPL licenses for the core distro, and thus not supporting binary code without source code).

As the case of the xz-utils package shows, this does not prevent that a widely used project is taken over by malicious actors, and stealthily malware becomes inserted. But the effort to do this is much larger, since this needs write access to the software’s source code.

And no, I don’t think Guix is the magical silver bullet for software security. But it is much better than unvetted shell scripts in AUR.

And of course, Guix has disadvantages, too. The biggest disadvantage is IMO that it is really slower than Arch’s pacman, because Guix - being based on source packages - sometimes builds stuff from source. But I think this does not matter so much if one is using it for ten or twelve extra packages. (It also got a lot faster with moving to Codeberg.)

In Guix, package definitions are part of the Guix distro and are vetted.

(You can still add your own local package definitions, or pull a package definition of your schoolmates friend from their web site or Codeberg repo - Guix is very open in that sense. But, in the same way as with Ubuntu launchpad and ppa’s or Debian third party repos, you would have to add that package source explicitly. It is not the standard way of distributing packages. )

Also, Guix is rapidly growing (31,000 packages despite it is relatively young). I think the reason is that it both allows for cross-language projects (If you want to publish a vector drawing program with image algorithm libraries written in C, a GUI done in in Python, and memory-safe media importers written in Rust - it is made for that!). And it runs on top of many larger distributions (I use it on Debian stable and Arch).

For people that just want to install packages that are not included in the Arch distro, and don’t have the knowledge or time to review PKGBUILD files:

Have a look into the Guix package manager. It works fine on top of Arch, and Guix has 31,000 packages now. Great for cross-language development and also suitable for early sharing of projects. npm support is a bit weak though, but packages written in Python, Rust, or functional languages are well represented.

I think the AUR is great if you are writing some program, want to explore some idea, and want to share it with people you know. Sharing freely is how all open source software is created initially. Open source needs that openness and could not exist without the creativity which the openness makes possible. That’s why Ubuntu for example has launchpad and ppas. But the AUR is not a good software distribution mechanism for people who just want to install and run stuff they have heard of, precisely because it is not vetted, and unsupervised. It can’t because the sheer number of packages it includes, over 114,000 .

By aware that the next target could be the Python / PyPy / pip ecosystem and repos. It is unsupervised, too, and users on average are less technical than Arch users.

“pip install” can run arbitrary code on your computer.

I suggest Guix because it is more looked after. It also has, which is essential, the openness mentioned above: You can pull any Guix package definition from your friend’s web site, and install it as any other package. You just need to configure the package source.

Have a look into the Guix package manager. It works fine on top of Arch, and Guix has 31,000 packages now. Great for cross-language development and also suitable for early sharing of projects. npm support is a bit weak though, but packages written in Python, Rust, or functional languages are well represented.

Are you aware how github works, or open source development in general ?

Some users are developers, too.

Some people write code, others may try it out, and a few of the latter might help with developing it. And some of these efforts become popular.

That’s how we have Linux or KDE.

That’s why Sourceforge was such a big win, why Ubuntu has launchpad and ppas, and why Arch has AUR.

It is all based on open sharing.

And of course you can opt to not run code that you don’t know, or don’t understand , or don’t trust.

Isn’t the issue then that the official Arch repositories don’t have many packages …?

Not at all. The official Arch distribution has tens of thousands of packages and the user repository / AUR probably more than 100,000 .

Edit: I looked it up:

• According to distrowatch.com, the Arch Linux distribution has over 17,000 packges by now
• Meanwhile, the number of packages in the Arch User Repository is 114,000 .

But who would do that? Do you have security expertise and are volunteering to do that?

But this is exactly what the top comment of Cease talks about: There is no moderation team. You seem to think that it is the job of the maintainers of the Arch Linux distribution is to vet and review the AUR packages. But they take care for the - much more widely used - Arch distro packages and are busy with this. They have enough to do. And the AUR packages are not part of the Arch distro.

The AUR is basically a server where users can store their own packages so that others can use it. As its name says: Arch User Repository.

Yes, we need a kind of Debian for Python.

Part of the solution could be the Guix package manager. Part could be the commercial offerings, like Anaconda.

Education has gone a long way to improving user response and caution against default trust of unverified contact

If that were true, nobody would run agentic tools.

Because these:

• perform actions on your computer, thus are executing programs
• operate on untrusted data -cannot, by principle, safely discern between commands and untrusted data

I guess this is marketing, too.

Isn’t there an IPO planned?

Unfortunately, social engineering works incredibly well.

So, better to use a safe language, and use

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs/ | sh

• right??

(I copied that from https://rust-lang.org/tools/install/ just a second ago…)

We are encouraged to use them at work, but it’s always a coin toss. Will it nail the task at hand on the first attempt?

A digital slot machine.

Addictive by design.

And moreover, it makes you believe that it did the work, while in reality you do all the difficult stuff and on top take extra responsibility for it. Like self-checkout supermarket counters.