Integrity, schmintegrity ¯\_(ツ)_/¯
Integrity, schmintegrity ¯\_(ツ)_/¯
This actually possible with most suckless projects since they are just a couple of hundred lines of C...
Don't ignore it, that's the practically the point. This is the perfect example of "don't trust me, trust the code".
> Because dwm is customized through editing its source code, it’s pointless to make binary packages of it. This keeps its userbase small and elitist. No novices asking stupid questions.
But it's not that. It's "don't trust me, trust the code as long as you're part of the select group of people that can read and understand the code given the language we use, which by the way happens to be well known to be hard to vet for subtle logic errors, which because of the nature of the language often result in segfaults (at best), or remote code execution (at worst)." Why not write it in brainfuck? They'll only change their audience by a minuscule amount compared to the original audience they could have appealed to, and they will be even more "small and elitist".
I originally translated "This keeps its userbase small and elitist. No novices asking stupid questions." as "We're a tight knit group of assholes, and if you didn't take the same path in life we did there's no point in talking to you." It may be unfair to assume that's their intention, but I think it is fair to say that's what they are doing in practice.
* a full checkout of libressl: http://git.sta.li/src/tree/lib/libressl
* a full checkout of expat: http://git.sta.li/src/tree/lib/expat
* two full /bins: http://git.sta.li/rootfs-x86_64/tree/bin http://git.sta.li/rootfs-pi/tree/bin
The point was that you can verify the integrity by reading the source code. The actual limits to this depend on many things.