It is terrible that this garbage has taken over the "open source" community - "just pipe this web page into your all-powerful command shell. Don't worry it's 'secure' because it uses HTTPS.". Even in the best case, it splays unreproducible junk all throughout your filesystem. Of course that doesn't matter because your Linux machine is a temporary "cattle" that you're just renting and accessing from your shiny iChromebook amirite?

Not having looked at it in a while, it is highly disappointing that Rust specifically has gone down this path on their main fucking page. "Old man yells at cloud", and all that.

IMO I think the future is distributed reproducible builds through Guix/Nix. I've never run Gentoo, but Guix/Nix feel like the best manifestation of software freedom that I've experienced. Mind expanding in the same way as functional programming or Lisp.

And of course none of that addresses the whole issue of source auditing and provenance. Immutable logs like git get us 90% of a foundation, but obviously there is a lot of unexplored territory required to provide actual security guarantees.

Nix eh? https://nixos.org/download.html#nix-quick-install

curl -L https://nixos.org/nix/install | sh

Unlike guix nix does not even have a way to verify package signatures because "it would hurt the workflow of these using the github webui to push stuff to nixpkgs"

That's what I get for trying to be constructive. The cancer is everywhere. The real rebuttal is just because a project's page tells you to do stupid things, does not mean you should do them (of course advocating that crap at all makes one question their general security competence)

I agree Guix has a much better story on foundational security (cf guix challenge). Nix seems to have more activity. Unfortunately, cancer spreads because it's good at multiplication.

But really my greater point is they're both source distributions revolving around persistent package/system management, which allow one to obtain software while managing the provenance of its code.