Let’s be honest, how many current Linux users can trust any code that they run? There’s so many guides and instructions where you essentially copy/paste commands to install or configure something that it would be difficult for your average user to verify everything.
If you feel overwhelmed by this, an easy rule of thumb is sticking to distro packages of a trusted dist. Ideally ones with long track record, centralized packaging and tiered rollouts.
Roughly,
High community trust: Debian, SUSE, Fedora, Ubuntu
Depends on the package but at least everything is transparent with some form of process, contributors vetted, and a centralized namespace: Arch, Alpine, Nixpkgs
Anything and anyone goes, you are one typo away from malware but hey, at least things get taken down when folks complain: AUR, GitHub, NPM, DockerHub, adding third-party ppa/copr
Let’s be honest, how many current Linux users can trust any code that they run? There’s so many guides and instructions where you essentially copy/paste commands to install or configure something that it would be difficult for your average user to verify everything.
If you feel overwhelmed by this, an easy rule of thumb is sticking to distro packages of a trusted dist. Ideally ones with long track record, centralized packaging and tiered rollouts.
Roughly,
High community trust: Debian, SUSE, Fedora, Ubuntu
Depends on the package but at least everything is transparent with some form of process, contributors vetted, and a centralized namespace: Arch, Alpine, Nixpkgs
Anything and anyone goes, you are one typo away from malware but hey, at least things get taken down when folks complain: AUR, GitHub, NPM, DockerHub, adding third-party ppa/copr
IDGAF:
curl | shProbably a bunch. But having the ability doesn’t mean it’s used.
Oh you want this cool terminal experience? Just run:
curl https://totally-normal-website.io/installer.sh | sudo bash