According to Jim Starkey, the person who coined the term, “Blob don’t stand for nothin’.” However, it is often referred to as a “Binary Large OBject”, meaning a large file with content not easily readable by people.

With an open source project, you have source code which is turned into executables/“blobs” by the compiler. As long as you trust the compiler, you can (functionally) know the content of the blobs by looking at the source code they were made from.

In the case of Ventoy, several “blobs” are included from an unknown or vague origin. This is a great way to bundle malware, as seen with the XZ backdoor from earlier this year. As such, the original creator of the linked issue is requesting they are built/obtained at compile time, so either the content or origin of these files can easily be found.

https://github.com/neonwatty/meme_search

Correct, Vector does not receive this information unless you willingly share it with them.

Element is able to use features called “Integration Manager” and “Identity Server”. When using an Identity Server, you can choose to link name, email, and phone number to your Matrix account. When using an Integration Manager, there’s a feature to share your location with others in chat.

As such, Vector discloses that they “collect this information”, although (except some diagnostics), this is completely optional.

(I am not associated with Vector, just interested in Matrix)

Although “custom Windows ISOs” are a big security risk, AtlasOS isn’t a “custom ISO” and running a random binary off some guy on YouTube is arguably just as bad. He has next to no knowledge of Linux, neither do any other “Linux YouTubers”. Trusting someone like that with your Linux machine is risky at best.

Lets go through the summary and see if anything is wrong or misleading:

Linutil is a distro-agnostic toolbox designed to simplify everyday Linux tasks. It helps you set up applications and optimize your system for specific use cases. The utility is actively developed in Rust 🦀, providing performance and reliability.

• It is not distro agnostic. There is Arch and Fedora specific code, which are not separated into modules, but part of other scripts. Outside of the package manager, it also relies heavily on systemd.
• Installing “Diablo II Resurrected loot filters” is not an “everyday task”. A lot of other scripts are similar, very specific, “one time use” things, not “everyday tasks”.
• helps you set up applications, maybe, but only if you count running sudo pacman -S networkmanager as “helping”, even when it ignores existing network configuration.
• “optimize your system for specific use cases”, it does nothing of the sort. There’s no kernel parameter tweaking, no other cpu scheduler, no IO options being changed, or anything remotely similar.
• “The utility is actively developed in Rust” except for the ~70% that is shell scripts. (according to GitHub)
• “Providing performance and reliability”, which is not something that’s determined by the programming language.

So lets revise the short description, to exclude any incorrect/misleading statements:

Linutil is a toolbox. The utility is actively developed.

Alongside all that, the “installation instructions” include the biggest sin of all:

curl -fsSL https://christitus.com/linux | sh

TL;DR Never trust Chris Titus, or any “Linux YouTuber”, with your Linux machine. They do not know what the hell they’re doing.

Despite the downsides of F-Droid, there’s one thing they provide that other stores like Accrescent simply can’t. F-Droid provides APK builds with the exact source used for the build available. There’s a lot of trust involved, but this trust is in a single entity, rather than random developers. F-Droid has existed for a long time without adding malicious code to builds, so when they say “this source code produces this APK”, they have years of history doing exactly that to back their claim.

A random app developer has no such trust built up. Stores like Accrescent, even if you download only FOSS apps, trust the app developer with building apps. It’s less prone to one massive takeover, but APKs built by random devs are much harder to verify and check for malicious code than the source code. If F-Droid is taken over, it should be noticed relatively quickly, but affects everyone using F-Droid. If an app on Accrescent bundles malware, only users of that app are affected, but it may go unnoticed for a much longer time.

Afaik the bug was never present in a release. The developer who quit had to jump through a bunch of hoops, and treat it as a security issue, when it only affected people running the latest git commit.

KDE Connect, and if needed, ntfy.sh.

I don’t have a direct source other than the source code of the software they use: https://github.com/mautrix/signal

When using one of their “cloud hosted” bridges, the bridge software (that connects between Matrix/Beeper and other protocols) has to read all message content. Otherwise, it’s impossible to bridge to another protocol. E2EE becomes end (other users) to bridge (beeper) encryption.

With “local hosted” bridges, E2EE stays intact, but messages can’t be sent/received if the device hosting the bridge is unavailable.

In the future, with MLS (a different E2EE protocol), it could be possible to keep E2EE even when bridging to Matrix on cloud hosted bridges.

iirc NPxSP was getting messy internally, the author went and rewrote a lot of things

per-site process isolation, as mentioned here: https://divestos.org/pages/browsers#processIsolation

My experience with several firefox-based browsers on Android was not usable, with constant freezes, crashes, and performance issues.

There are some security considerations to using a Firefox-based browser on Android. In my experience, performance and stability has not been as good on Firefox Android as Chromium Android.

https://divestos.org/pages/browsers

Depends on how it’s implemented. Anyone using a “media proxy” will see their discord bridged media probably fail to load (outside of possible caches) after a day. Anyone who has their bridge configured to reupload discord media to their homeserver should see no change.

Not just the “lack of APKs”, but the lack of a FOSS build. As you noted, it is possible to instal an AAB by extracting the APK(s) inside, but that doesn’t magically remove non-foss libraries.

The only build is an aab file. This is a Play Store bundle file, not an APK, so not directly installable in Android without the Google Play Store.

The only build being a Google Play release also indicates that non-foss libraries were likely included, such as the FCM libraries, as is common for GPlay releases of otherwise FOSS projects.

As far as I’m concerned, Element X for Android is not available yet, unless either building from source (with modifications to included libraries), or by using a non-FOSS version from GPlay.

Your iPhone 13 syncs slower over USB because Apple decided to stay on Lightning connectors, which use USB 2.0 on the other end. Although FireWire was faster back when it co-existed with USB, the USB standard has surpassed it a long time ago with more power, faster speeds, and better physical connectors.

VRChat in particular has been degrading in quality and experience ever since they needed to start pleasing investors. You can give it a try if you want, but there’s a lot of toxicity there. Platforms like ChilloutVR or NeosVR have a better (but smaller) community.

Although some titles like BONELAB or Pavlov do feel a lot more like “tech demos”, they are still great titles. Some desktop titles also have VR ports that are worth playing, No Mans Sky and The Talos Principle come to mind.

The modding scenes of a lot of games have good VR mods too, “Vivecraft”, if you’re into Minecraft. Subnautica has a good VR mod, Half-Life 2, Deep Rock Galactic, Outer Wilds, and much more.