Hacker News Reader

Comment by skinfaxi | Hacker News Reader

It's even reflected in the language used by younger generations, asking if things are "allowed" or assuming things are illegal by default.

View on HN

I don't think anything has changed in the world. I suspect that you, like I, and lots of other hackers, had a very different group of friends growing up, and you didn't realize how insular your community was. Now as an adult you're seeing kids who are outside that particular narrow friend group, and attributing the change to the kids, rather than your to wider perspective.

>asking if things are "allowed" or assuming things are illegal by default.

There are plenty on HN who are "old enough to know better" who do it anyway. The most evil know that's not how things work and do it as a performance to influence others.

In some Linux distros like Debian, everything is illegal/prohibited until you explicitly allow it and only comes with the bare minimum of software necessary to make the OS work. Contrast that to other distros like Ubuntu where everything comes preinstalled and is very permissive. These obviously target different audiences. Smart phones are targeting different audiences too. The power users annoyed by the dumb things the device does just means you're not the target audience and are just bonus buyers for their bottom line.

> In some Linux distros like Debian, everything is illegal/prohibited until you explicitly allow it

Bit of a nitpick, but this is certainly not true of their userspace, where an `npm install` can just install a keylogger or read your ssh keys, or do whatever it wants -- except for updating your video card driver.

I would hope that someone deliberately choosing to run a headless Debian install would be wise enough to not go around running `npm install` willy nilly. In my personal experience, I've never once needed an `npm install` in Debian environment. I've only ever used them in server environments and to be honest thinking about it, that was all pre-npm when javascript was kept where it belonged in your browser and not my server. Someone screwed us all allowing JS on the server, but that's an entirely different conversation.

Well, it's enough to use a trusted app as your own user on non-trusted data. The former just has to have a memory vulnerability, which is not rare given most of it is C.

So yeah, don't be so confident in it working out. Unfortunately gnu/linux desktop is severally lacking in security (and by desktop I mean a headless personal use as well)

I used to run npm install unsupervised from a script on headless Debian that I deliberately chose dozens of times everyday. Later I moved my CI to Alpine.

Complete nonsense. You get passwordless root upon install.

Side effects of living in an authoritarian panopticon

Reply on news.ycombinator.com