this post was submitted on 14 Jan 2026
198 points (95.4% liked)
Technology
78705 readers
2965 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
As we push more average Windows users to Linux, we need to be prepared for these users to download and run completely untrusted code.
Let's be honest, how many current Linux users can trust any code that they run? There's so many guides and instructions where you essentially copy/paste commands to install or configure something that it would be difficult for your average user to verify everything.
If you feel overwhelmed by this, an easy rule of thumb is sticking to distro packages of a trusted dist. Ideally ones with long track record, centralized packaging and tiered rollouts.
Roughly,
High community trust: Debian, SUSE, Fedora, Ubuntu
Depends on the package but at least everything is transparent with some form of process, contributors vetted, and a centralized namespace: Arch, Alpine, Nixpkgs
Anything and anyone goes, you are one typo away from malware but hey, at least things get taken down when folks complain: AUR, GitHub, NPM, DockerHub, adding third-party ppa/copr
IDGAF:
curl | shProbably a bunch. But having the ability doesn't mean it's used.
Oh you want this cool terminal experience? Just run:
curl https://totally-normal-website.io/installer.sh | sudo bashFriends don't tell friends to "Just
curl shiny.tool/install | sh" or "Justgit cloneanddocker-compose up".You know, I have encountered a lot of "just pipe curl into sh" from people who absolutely should know not to do that.