https://plspace.shit.nexus lets you customize your profile with custom CSS and anybody who uses plspace also will see your style your own profile!
Timeline
Post
Remote status
Context
11@sun@shitposter.world Where is the source code?
@sun@shitposter.world I spot 20 emdashes in the tiny readme file and you didn't even add the .claude folder to your gitignore.
Also I can't read what license your repo uses without being required to make an account on your forge.
0/10 vibecoded retroslop
@SuperDicq AGPL. you can access it without bullshit via:
rad:z2gAKC6ESt5ZBV419uVPf2vFtEHCT
I use Radicle now because scrapers I have to lock down gitea
rad:z2gAKC6ESt5ZBV419uVPf2vFtEHCT
I use Radicle now because scrapers I have to lock down gitea
:D
@CapitalB@noauthority.social @sun@shitposter.world Of course that's not how you should actually install it.
@SuperDicq @CapitalB @sun i still don't understand how downloading and executing a binary is any safer than curl | sh
@snacks @SuperDicq @CapitalB @sun there are ways you can fingerprint a curl | sh and sneak a malicious script in. Besides that, you can't read the installer source when doing that.
@phnt @SuperDicq @CapitalB @sun so you don't trust the devs of this sofware as far as the installer goes but the rest of the program is fine?
@snacks @SuperDicq @CapitalB @sun I can verify a binary if they provide a signed checksums file. You cannot do that when you blindly pipe a script into sh. It's not about trust really, but about avoiding compromised sites/installers.
@phnt @SuperDicq @CapitalB @sun you can only verify that it's the same binary/a reproducible build of another binary
Replies
3
@CapitalB @SuperDicq @phnt @sun it isn't quite clear to me why it'd be harder to serve bad stuff one way or the other
@snacks @SuperDicq @CapitalB @sun If the checksums file is signed with the developers key published elsewhere, or on a key server. You can publish fake checksums all you want, but the signature won't be correct against the developer's key. Only a hash collision would be an issue.