as soon as you realize you can’t easily contain your commit message within a 50-character conventional message (or slightly more if you wand to be more specific about the scope)
Also regarding tiling compositors/WMs. Base rate fallacy. Yeah desktop linux has got 3% market share but probably somewhat more if you exclude company or public computers. But then, probably also higher among Signal users. Anyway, that’s probably an Electron issue. Glad to see Flare getting better, so hopefully if it doesn’t get abandoned we might soon have a viable alternative that is more lightweight, secure and integrates better with the system in a more agnostic fashion. Heck, I might be even inclined to contribute a little to that project myself.
It wasn’t my intention to state that an extensions of certain big software is always better or should get all the credit. No. First of all, I consider Molly protestware and second of all, the thing about being able to do federation and whatnot with much smaller funding was not about Molly. It was about simplex, matrix, XMPP, E2EE for Fedi and handful other decentralized/federated projects. Signal already has been downloaded hundreds of millions of times according to App Store/Play Store and received countless endorsements. And they did in fact face outages after receiving one from Elon Muskrat. So, they needed to find ways to scale better. Their server software could in theory be self hosted, but unlike Matrix or XMPP, it won’t federate so in a way it’s even worse than e-mail when it comes to this. One would thus think that it’s implicit that they would finally add the possibility to let people run their own servers or even devolve towards more P2P-oriented design. But instead they’ve decided to partner with a pump and dump shitcoin scheme whose privacy-friendliness was absolute trash, though granted, that was also at a time when every tech company was trying to join the Web3 hype. Now their reach is even bigger, but has grown at a steadier pace. I won’t try to go more tinfoil here with any unsubstantiated suspicions and begging the question but even though decentralized or federated systems are harder to design in a way that makes them secure, centralized ones are more abusable and create a single point of failure that can affect a large share of the user base.
yep. Good code is self-documenting and syntax highligting and having longer sections folded up may help more than having to process some greyed out text. But comments are still useful for generating proper autocompletion and avoiding having to skim through you '“self documenting code”. Also it helps greatly with TDD and maintaining good coding practices. For example if you need a numbered list to reliably sum up what some function does, it’s often a good sign that it should be broken into a couple smaller ones.
I see your point and don’t negate such possibility. Although the black box nature of proprietary dependencies in vanilla Signal means an inclusion of potential trojan spyware. Speaking of the need for app lock, as an alternative solution, you can create a separate profile for Signal to have a dedicated PIN. But afaik only GrapheneOS allows notification relaying to main profile. LineageOS on the other hand has a feature called AppLocker. If you intentionally lend your device to kids, Android has a feature called app pinning.
maybe try setting up a matrix bridge if you feel confident you can secure that properly. On one hand it might increase attack surface (use only servers and bridges with End to Bridge Encryption) but what’s an attack surface on software that is so ridiculously compromised. Also you can try using an alternative client such as Flare. Though YMMV, for me the last time I’ve used it it was quite rough around the edges but I’m happy to see it’s actively maintained so might be worth checking out.
Also no, flatpak doesn’t fix this issue. Yeah it provides some isolation which can be further improved with flatseal, and other defense-in-depth methods. But unless you are willing to face the trade-offs of using Qubes, you won’t compartmentalize your entire system. The key file in question is stored in ~/.local/share. I’m not denying vulnerabilities in userland applications, but thanks to it’s wide reach, often massive codebases and use of unsafe languages like C, it’s the core system or networked software that is the most common attack vector. And that doesn’t ship and will never ship via flatpak.
The most obvious way this is exploitable is directory traversal. But not only that. Just look up “Electron $VULNERABILITY”, be it CSRF, XSS or RCE. Sandbox escape is much easier with this crap than any major browser, since contextIsolation is often intentionally disabled to access nodejs primitives instead of electron’s safer replacements. Btw Signal Desktop is also an electron app.