@chris2be8

I agree. Lots of things aren't a problem for people who understand their system. The issue is non-technical users.  Sadly it is those same user who will not made the effort to configure their system properly. Of course I'm sure those users are using sudo, so it's not an issue.

OK so let's just not make any effort and just let it all be completely proprietary and controlled by the big corps and the government.  I really only see the 2 options: FOSS or private controlled. As I said you can't stop it. Or is this just about complaining? Gloom and despair the worlds gonna end.

My point is not that it's a good situation. Just that we should at the very least go down fighting.

. . . and maybe I should of said "help level" which was what I meant.

You can't stop advancement. It's a race, but the more that it is developed in the open with an FOSS license the better.  If it's not for everyone it will be abused.

Update, commands specified using nopass are limited to the restricted PATH.  So that's good.

But it still seems that you could still do damage with a fake executable, even if a password is required.  Just put it in the local path (in $HOME)  like I did with the whoami example above and the user will be tricked to give the password.

of course a better example would be apt because why would you you'd be less likely to use root for whoami.

I had already thought of that when I made my last post, so I tested it.

I created a fake whoami file in my local path ~/.local/bin/ that simply echos HAHA!  The results:

regular user - runs the fake whoami
with sudo - runs the real whoami
with doas - runs the fake whoami

Yep security issue.  So you might want to use full path when adding nopass commands.

update : Does not affect nopass commands. See post below.

. . . cricket sounds . . .

The party died without golinux here

The system I tested on I only installed the standard system tools or utilities whatever it's called.  You know the tasksel menu on the devuan/debian installer. No DE or anything else. It was the only thing selected.

of course then I manually installed the xserver, jwm, and more.

Thanks yeti!

You are correct,  use a colon for groups, and no colon for usernames.

Why did it work for me? you're not gonna believe it. I belong to a group with the same name as as my username. What are the odds. lol.

As I said I usually use groups instead of a username, and since my test with usernames worked with the colons I assumed that was the correct way.

Still my other 2 points are valid. use the full path and the args did not work form me.  .  . and yes I did test the args after removing the colon.

Great news!

OK! Who are you and what did you with the the real zapper. LOL

Seriously though, You have a good point. It's next to impossible to have an absolute stance on libre software and have a full functioning machine. To much hardware depends on blobs. The best you can do is minimize the usage of blobs, and try to use hardware that does not depend on them.

Not to mention being force to compromise on these issues when collaborating with others.  For example, on a recent project I've been force to use systemd.  Yuch!

Warning! My Long winded opinion

This question hits at the heart of the matter.  The truth is any type of software package, archive, etc can be used to spread malicious content. An appimage isn't any less secure than a .deb.  The real concern is not the format, it's the source. You really can't go wrong if it comes from the Debian/Devuan repository. I only use these formats as a last resort. To be honest they are probably safer than using random packages from the AUR. At least the portable formats attempt to sandbox the software. Just a thought, not defending these formats.

I'm not going to limit myself to only the software provided in my distro’s repository, but on the flip-side I am skeptical, and examine foreign packages carefully.  A stance I believe many, if not most people take.  JWMKit is not in the Debian repository, but I can proudly say it is used by many. Quite a number of users directly use the packages provided on my sourceforge. I am very transparent and not only provide the project code, but also the methods used to create packages.  I think this kind of transparency encourages trust between users and developers.

My concern for these formats is more about not wanting to have corporate junk pushed onto me, and having unnecessary service running in the background. As for the security of these formats I think it’s an issue that can be resolved by pooling the resources of the community.

...but to be honestly I’m still hoping snaps and flatpaks fail.

I find that searching the AUR is a great way to find software, and there are a lot of circuit simulator listed. Just follow the links to the upstream source (github, etc). You may even find a few are already available in debian.

AUR Search for circuit simulator

While not a simulator, my favorite circuit tool is DIY Layout Creator.  It's excellent for designing you own guitar pedals and it should be since originally that was it's intended purpose.

DIY Layout Creator