From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gentoo-user+bounces-202131-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits))
	(No client certificate requested)
	by finch.gentoo.org (Postfix) with ESMTPS id 6AEAA158089
	for <garchives@archives.gentoo.org>; Mon, 16 Oct 2023 20:54:58 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
	by pigeon.gentoo.org (Postfix) with SMTP id 106AE2BC031;
	Mon, 16 Oct 2023 20:54:53 +0000 (UTC)
Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(No client certificate requested)
	by pigeon.gentoo.org (Postfix) with ESMTPS id A2A822BC01F
	for <gentoo-user@lists.gentoo.org>; Mon, 16 Oct 2023 20:54:52 +0000 (UTC)
Message-ID: <0e6a9eed23a7bb0c98166642978a62cb35c627ed.camel@gentoo.org>
Subject: Re: [gentoo-user] gradle as source? How safe are overlays?
From: Michael Orlitzky <mjo@gentoo.org>
To: gentoo-user@lists.gentoo.org
Date: Mon, 16 Oct 2023 16:54:29 -0400
In-Reply-To: <6c94c6e9-8736-c8c1-a47e-b0657d4cfbc7@web.de>
References: <6c94c6e9-8736-c8c1-a47e-b0657d4cfbc7@web.de>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.4 
Precedence: bulk
List-Post: <mailto:gentoo-user@lists.gentoo.org>
List-Help: <mailto:gentoo-user+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-user+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-user+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-user.gentoo.org>
X-BeenThere: gentoo-user@lists.gentoo.org
Reply-to: gentoo-user@lists.gentoo.org
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
MIME-Version: 1.0
X-Archives-Salt: 47ac948c-c990-49d7-bed8-55948f5804fc
X-Archives-Hash: 5da4dd58e141aeda607a59909d217e0c

On Mon, 2023-10-16 at 21:29 +0200, n952162 wrote:
> Why might it only be in an overlay?

Because it bundles 100+ other packages. That is inherently a security
risk, although plenty of people use Windows and install all of their
software that way and are perfectly happy on those days of the year
when their documents aren't encrypted by ransomware.