#nobridge

  • 0 Posts
  • 8 Comments
Joined 1 year ago
cake
Cake day: March 14th, 2025

help-circle


  • anamethatisnt@sopuli.xyztoPrivacy@lemmy.worldIce Privacy
    link
    fedilink
    English
    arrow-up
    5
    ·
    3 days ago

    Yeah, sorry, I read your “will you give them a chance” as asking for my personal thoughts on the matter. That not everyone has the know-how doesn’t stop me from self-hosting. ;-)
    My advice when it comes to external services - never trust them to keep your data safe. If the data is important to you keep your own backups.
    An example is when TietoEvry, one of the largest IT service providers in the Nordics, lost up to 20 years of archived data for their customers.




  • Yeah, somewhere along the line you end up with a question of trust. “Do I trust the developer of this AppImage?”, “Do I trust the result of this automated tool that checks the code for malware?” or “Do I trust my IDE and myself when I downloaded the source and tried to verify it in my sandboxed VM?”.

    My main point was that the hash doesn’t really tell you anything about the source, except whether you got an exact copy of it or not.



  • Personally I’m more against the concept of downloading random Appimages from github.
    Unless you’ve personally gone through the repository code and know that it is clean and safe the hash tells you nothing of importance in that regard. It can be used to verify that the file is complete and didn’t corrupt during the download and ensures that no MITM attack went through undetected.

    Flatpaks are at least isolated and when you grab a popular package from flathub one can hope there would be an outcry if it’s unsafe. AppImages per default get full access to the user /home.