← Back to context

Comment by PorciiVorbesc

7 hours ago

Probably because pop_os and Cosmic are so niche and their market share so insignificant, that they're irrelevant to attackers and bad actors, when those now have much bigger fish to fry to make their time and effort worth it. See the Arch AUR attacks, for perspective.

I think even amongst the HN and Linux userbase, pop_os is still niche, let alone amongst normies who never heard about Linux. So they can afford take the high road and treat it like their personal sandbox, accepting only human written code.

But larger and more important projects like Fedora and Debian are more pragmatic with the fact that they'll have to accept AI written(but human reviewed) code, if they wish to keep up with the real world development and threats, as expressed by Linus Torvalds himself.

The thing is, the cat's out of the bag on this one now, especially in the field of pen-testing and reverse-engineering. AI can brute-force its way into projects in ways that beat even experienced researchers, so your only choice to keep up is to accept the use of AI generated fixes as a counter defense.

37 comments

PorciiVorbesc

Reply
satvikpendem  6 hours ago

You only need one bad actor. For example, someone reading this thread could easily decide to start attacking it just because someone else said it wasn't worth it, as a personal challenge.

  • PorciiVorbesc  6 hours ago

    >You only need one bad actor.

    If that's your threat model then you shouldn't use any SW in exitance, FOSS or otherwise. In fact you shouldn't even go online, or even outside you own house, since one single bad actors exist everywhere. You can walk down the street and suddenly someone in a car runs you over(witnessed myself). And yet live goes on.

badc0ffee  6 hours ago

It does show up on top 5 lists for Linux desktop distros quite a lot, and COSMIC is quite unique, so I suspect a lot of people are at least trying it.

(I wasn't able to make it work on a scrap Dell I tried it on because the GPU was too old. Booted the USB key and COSMIC greeter failed to start)

  • PorciiVorbesc  6 hours ago

    >It does show up on top 5 lists for Linux desktop distros quite a lot

    1) Firstly, your source plase? My research according to Google Gemini 3.8 Pro shows top 5 DEs are as follows:

      +---+---------------+------------+-------------------------------------+
  | # | Environment   | Est. Share | Primary Ecosystem / Defaults        |
  +---+---------------+------------+-------------------------------------+
  | 1 | GNOME         | 45% - 50%  | Ubuntu, Fedora, Debian, RHEL        |
  | 2 | KDE Plasma    | 25% - 30%  | SteamOS, openSUSE, Kubuntu, Manjaro |
  | 3 | Cinnamon      |  8% - 12%  | Linux Mint flagship                 |
  | 4 | Xfce          |  6% - 9%   | MX Linux, Xubuntu, low-spec PCs     |
  | 5 | MATE          |  2% - 4%   | Ubuntu MATE, Mint MATE (GNOME 2)    |
  | - | Others / WMs  |  3% - 5%   | Hyprland, i3, Sway, LXQt, Budgie    |
  +---+---------------+------------+-------------------------------------+

    So then COSMIC isn't even TOP 5, for this to be a major target by market share as originally claimed.

    2) Secondly, keep in mind that distrowatch is not representative of linux userbase. MX-Linux kept showing up at the top spot for many years despite being niche.

    3) And thirdly, TOP 5 DE isn't really an achievement when Linux DE market share is overwhelmingly dominated by KDE Plasma and Gnome as the majority shareholders, with XFCE and Cinnamon trailing. So Cosmic DE if it somehow made the no. 5 spot, would still be ignorable sub <1% market share, as I initially claimed, basically invisible to bad actors.

iugtmkbdfil834  6 hours ago

<< Probably because pop_os and Cosmic are so niche and their market share so low, that they're irrelevant to attackers and bad actors, when those now have much bigger fish to fry.

That is such a weird statement that I am not entirely certain where to begin. PopOS is hardly niche. Its base are all fairly common components by linux standards. And, more importantly, attackers and bad actors may other considerations in mind than sheer population size -- just to point out the glaringly obvious.

<< I think even amongst the HN and Linux userbase, pop_os is still niche

I think rather than trying to disprove it, I think I should ask why you think that? If anything, PopOS annoys me because it is just a step before ubuntu ( and ubuntu is just windows at this point ). Maybe I am defensive, because my first real distribution ( that did not share disk with windows was popos )?

DelightOne  6 hours ago

It also means security is not held as high and vulnerabilities not as much found. A simple 0-day may survive for years. Not much effort needed to have permanent access.