Quoting: Kimyrielle

Quoting: MakiNote that both vulnerabilities are for a local user to gain root access.

They're being blown up out of proportion, if you ask me. And I'm not happy at all about the tools used to find them or the methods to reveal them before a patch could be written and distributed.

I would caution against calling this "out of proportion". I think people wrongly assume that a "local" user has be at your keyboard to do damage. This is NOT the case. Everything you run is a "local" user, namely the account you typically work with. In this world of dependency hell, all it takes is a supply-chain attack. Someone could easily sneak some code into something you download and execute with your local privileges, and boom, you're toast.

Out of proportion is still fair as there are articles/headlines everywhere that absolutely are doing that - you're not wrong that it's still important to deal with. The kind of important to update when you are able and not really wait, but no reason to cancel plans or act like the sky is falling sort of thing either - unless you run a web server of any type or are otherwise more susceptible than an average desktop user. I will also always beat the drum about caution regarding supply-chain in general as well, and remind people that rolling distributions and languages that download 50 billion modules to do anything in a similar manner are and always will be a risk nobody actually has to take.

View this comment - View article - View full comments

Quoting: rustynail

Quoting: The_Real_BittermanThere are people not using the official flatpak? Geez ...

It's actually news to me, I think last time I checked it still wasn't official, and it had a bunch of issues like shipping an old version of discord for months because the current one used a version of electron that broke something. And of course they had to use some weird hack to make an old version work with current servers.

That's one of the main issues with Flatpak IMHO, although in fairness, that situation has improved recently in that it's become far more clear in various places that they're not actually official packages because they definitely gave that appearance prior to the changes. Couldn't tell you when that change happened since I'm not a fan personally, and don't touch them more then I have to.

View this comment - View article - View full comments

Not all that uncommon of a practice. At least some publishers tend to use things like Denuvo for release date protection, and past that for the initial few weeks of sales (which for most games is the majority of sales/the most important). Then they remove it because it's no longer actually needed in a business sense.

View this comment - View article - View full comments

Quoting: vic-bay

Quoting: ShmerlI think it's good — looks like they made GOG private so they can pursue their own vision and not be pressured by shareholders of CDPR.

I.e. may be they can spend on Linux now more, while before shareholders could tell them not to prioritize Linux support. Just my guess. In the end, it's really up to what they want.

yeah, looking at valve and other game companies, private company is a better model for company-customer relationships. it allows for following long term strategies without being pressed by shareholders.

In my experience it really depends. Private is great but usually only when a company starts. Not speaking about GOG specifically, but in general, when a public company "goes private" the $$$ often comes from private equity firms which in turn is typically absolutely terrible for everyone - meaning both consumers AND employees, especially employees - other than the top-most leadership themselves. When you work for a public company that announces going private, it's frankly a good idea to start brushing up the resume and looking ahead to your next career move, even getting a jump on it, before you get surprised.

Anyway, at least with GOG it sounds like it's probably fine or even a good thing. Reads to me like this move is just saving GOG's existence before future changes occur; Which is great.

View this comment - View article - View full comments

I long ago gave up using the actual client, I don't need fifty different browsers disguised as apps running.

Works fine, and frankly better performance-wise, as a pinned tab in Firefox.

View this comment - View article - View full comments

My understanding of Fedora is it's essentially a test bed for Redhat. As in it's generally stable, but if you want to depend on it, you should... probably use something else because things will happen sometimes and they will fix it, and repeat.

View this comment - View article - View full comments

Calling out Linux always just feels like vendors convincing devs that their windows-only Anticheat is the best choice for them and are just closing sales/driving adoption.

View this comment - View article - View full comments

Might be a matter of preferred genres. I'm mainly playing point and click and puzzle games.
I also usually play a game until it's finished and don't come back.
There's enough new stuff to play.

Could be. Or it could be the same popular games, that kind of thing. I know a while back I was playing through Black Mesa, which has native linux support, which became completely unplayable in some scenes for me if there were too many particle effects. I switched to the windows version/proton to work around it and playing it that way worked perfectly with no issues. I did see a major patch came out for this game a while back, so maybe that fixes those issues?

I guess off the top of my head that's truly the only one that comes to mind for me, at least via Steam, so perhaps it's the Steam Linux Runtime working wonders. I've certainly seen news blips of developers dropping linux ports due to bugs/maintenance, but I'm not positive those are ever games I actually play myself.

View this comment - View article - View full comments

Just to those worried that Proton kills native ports. That may be true, but I'll remind you that...

• Many of the native ports lag behind
• Or, they're buggy
• Rolling distros along with non-rolling distros make Linux difficult to support in a single "Linux" build. Not a new issue, but much more prevalent now than it used to be.
• The Steam Linux Runtime solves some of the previous issue, but if you require Steam, what's the difference at that point to using Proton practically speaking.

That said, I'd also like people to consider the possibility that things change over time. A big issue for most developers/publishers when supporting Linux has always been whether it would be worth the resources to do so for the limited customer base. Remember that the goal is to grow Linux market share, it's only us nerds that care about native or proton. Ideally, if Proton can bring more people over to Linux as their daily driver and grow that market share, than more power to Proton.

View this comment - View article - View full comments

If you don't need HDR and/or "actually good reasons" for using Wayland, IMHO Mint is absolutely the best choice for most users beginner and power alike.

I'm a big fan of Mint XFCE in particular, and really, edition is important as well. Many of the times when people say what they use instead, they include/say a particular flavor, but often don't when they talk about Mint for some reason.

Ubuntu/Canonical needs a buffer, and the Mint team does an excellent job of it.

Talking about this Mint release however, I was very pleased to see the changes in Software Manager clarifying flatpak usage, and what that means, though I think it can still be clarified further (to a certain degree, I'm not sure just how much of that is really the distro's responsibility beyond what they're now doing). In particular a rather systemic issue with flats and similar is it can be unclear who is really maintaining those, and whether the maintainer in question even has permission to do so, etc.

View this comment - View article - View full comments