I don't think that narrative is supported by the numbers. Arch's repositories are about a magnitude smaller than either the AUR or "batteries included" distributions like Debian. (about 10k to 100k packages), there are more people using Arch derivatives than arch, and according to some community polls, granted I can't verify their methodology, something north of 90% of arch users use the AUR.

If you look at the most popular packages in the AUR, it's the most popular web browsers, virtually every VPN client, popular professional software like davinci, incredibly popular messaging clients, Spotify, Zoom, billion+ userbase software and the vast majority of password managers.

And if you look at who maintains those, it isn't the company, in many cases it's a random pseudonymous user who doesn't show up on Google. And I don't get this strange aggressive tone of suggesting I use something else. I do already, because as should be obvious I think that's a bonkers security model, but it deserves to be pointed out.

I do not think that the majority of people running arch today in practice realizes that their password manager they installed from that repo everyone uses is managed by an absolutely random person on the internet.

but it's worth asking why it's been working well. Has it been working well simply because it's been a niche ecosystem, or even because you wouldn't have known if it didn't because nobody did security audits?

The Arch distribution model, which operates like the Javascript ecosystem, as in having a barebones core and then a zoo of unregulated third party community packages does not seem fine these days. As it became more popular it has naturally drawn attention and from that moment on you're just screwed because you have no security infrastructure. Arch pretty much lived off security through obscurity.

And in particular with the popularity of these spin offs, I forgot what the name of the tiling wm thing is that got very popular, I think a lot of users are not aware that they're doing the software equivalent of buying medicine off craigslist

but even that doesn't really hold any more. The great slopification has made it so that people don't even associate that kind of thing with reliability. Instead it's gotten a kind of ca the year 2000 "thing out of a Chinese factory" vibe to it. Even on practical grounds you might as well give it your own shot now because that stuff is poisoned.

As a concrete example, if you wanted to make a Github competitor ten years ago you tried to look like Github, now you're better off trying to look like sourcehut or codeberg because you don't look like the thing that dies every five minutes.

yes, and who wants creativity and risk when everything can look like the interior of a McDonalds. I'd much rather look at someone's terrible and scuffed attempt at designing their own page, because it at least signals that there is a human who isn't afraid to try something out rather than the Instagram filter version of a webpage.

https://web.archive.org/web/20120502000130/https://jtnimoy.n...

Also the shelf metaphor is itself troubled because you're not even really selling any widgets for profit, you're just handing them out for free at the expense of hundreds of billions in investments that really are going to deprecate pretty fast

for the same reason Vladimir Putin should listen to Russian milbloggers rather than his own subordinates, the metrics are being cooked up by people who get promoted for good metrics

For one even in the short term this is benefiting China as its the largest renewables producer in the world and much less exposed to ME fuels than Japan and America's allies, who are to put it in plain English, fucked. (Japan gets 80-90% of its resources from the Gulf, China ~15-20%)

Secondly the only thing that wakes the American voter out of his or her perpetual stupor is the cost at the gas station, and every single person responsible for this will be voted out of office. I cannot imagine that even the oil industry wants a blue wave just because they could crank the prices for a few months

what the Swiss are trying to do here is very uncommon, in fact it's so uncommon literally nobody has ever done it before. No country in history has imposed a numerical population cap on its population, and in addition, freedom of movement isn't a detail. It's the very core of the Treaty of Rome and the Schengen agreement that Switzerland is part of. That Europeans can now move freely between countries is the bedrock achievement of virtually all its labored for.

And the EU is not going to do braconian measures, the EU does not bully its smaller neighbors. Britain wasn't intimated, threatened and nobody tried to interfere with it when they wanted to leave. THey decided to do so and did. Swizterland can cap its population and deny freedom of movement, nobody's going to bully them, but they're obviously not going to have the relationship they had with the EU.

To even rhetorically compare the EU to the US (which has threatened to annex an ally's territory) or China (which throws minorities into camps and threatens a democracy with force) is pretty damn absurd. Ask Taiwan if they want to trade places with Switzerland on the world map if they could.

This is a strange framing that itself usually comes from a standpoint of moral superiority. When you sign agreements with a governing body, like the EU on freedom of movement, and you break that agreement then there's consequences. And I don't mean that in an underhanded agressive way, but just literally you've broken the terms you had negotiated.

The superiority complex really often seems to come from countries like Switzerland or the UK in the Brexit situation. Countries that already have often privileged deals and then decide to forfeit them, which they are allowed to do, it's not an attack on their sovereignty, the EU is not mainland China and Switzerland or the UK were not Taiwan, they're free to do what they want, they just can't have their cake and eat it too.

I have no idea why people are making some mysterious deep question out of this, wikipedia quite literally offers a definition[1]. Web 2.0 based platforms, user generated content, social networking including social mechanisms such as followers, groups and lists.

This doesn't apply to HN. You could randomly assign everyone a new name tomorrow and it wouldn't matter. Identity is virtually irrelevant here, there are no mechanisms to connect users to each other, there are no networks of people, users do not generate their own content and there is a criterion that what is discussed is of of public, not merely social or personal interest.

If some crash wiped out all HN users tomorrow and we'd all start over at zero almost nothing would change. If that happend on social media, like Instagram, the site would be dead. That's the social part.

[1]https://en.wikipedia.org/wiki/Social_media#Definition

I do hope you see the irony of accusing people of armchair psychology and then hitting us with the five stages of grief.

I trust rsync (which handles critical data on my system) because I know a veteran of 40 years wrote the code it runs. If I see code like the one above posted by the OP, that the author wouldn't have written, I start to pay attention. When I then read the blog post of him saying that he'd "rather go sailing than fix rsync issues", I start to question whether the software is still written in a way I can trust and where it's going quality wise.

The problem isn't this weird gaslighting attempt that we just haven't let Claude in our hearts and souls yet which you seem to have determined is inevitable (spoiler alert, it is not), it's that a bot wrote crappy code and I wasn't even aware I was running it and now don't know to what standard this project is held.

because no person can read every line of code written in software they use, or track every commit made to a project. Integrity and authorship matters. If a person lies or obfuscates the origin of what they produce, an article, software, what have you they're doing it for a reason, otherwise they would be honest. That's not prejudice, that's recognizing deceit. And you don't eat fruit from a rotten tree.

For comparison I assume you're German given the username, here this would amount to 300 billion per year, which is about 100x what the government spends on BAföG (the mentioned federal student aid). I genuinely wonder how much countries will have to spend until people realize that this has quite literally nothing to do with money.

there isn't much evidence that this is happening. When you eyeball the average age of maintainers on mailing lists these days for prominent open source projects like the linux kernel, it's been steadily creeping up, to somewhere in the 50s now I'd guess. There's a complete dearth of people in their 20s or even 30s in particular in positions of responsibility, there's no next generations of leaders.

That's fatal in the long run. You need to have an apprenticeship system or something like a vocational pipeline to engage people in a structured way so that you can produce talent and also be objective and systematic. Something like a guild system you have in the DACH region where companies survive centuries, and that's not because random people write mails, it's because there's a industry wide support system and training process.