Not to mention the Nazis, too, tried to get rid of trans people. And all the "undesirables".

Doesn't the Bible also say that there's nothing you can do to bring the end times around faster?

So why not do objectively good things until then, instead?

Maybe it's one of gods tests, and he wants to see if you're a good person even in the face of inevitability.

I can't with these religious people.

The point is not that pulling any project from the asset store is insecure. It is for any code you download onto your computer that can execute arbitrary code. (In fact, yeah, the asset store itself could be dangerous, as it encourages people to download a package without first being able to inspect it. Again, I personally prefer pulling from a repo, which I can check out beforehand.)

The point is that a bad actor might be able to put themselves between your repository and the exact package version you're attempting to download, and give you something you did not expect. The checksum helps ensure that what you're getting was not tampered with, whether it by a man-in-the-middle, a hacker of the asset store, a hacker of the asset owner's account, or a malicious asset owner.

OP accepted the feedback, but they appeared to be.. let's say "more emotional" than others in this thread.

But hey, I appreciate you looking out for OP. They don't deserve to be piled on. I'm just trying to explain why I said what I said.

Scrolled down a bit further and came across some threads pointing to this issue:

https://gitlab.com/AuroraOSS/AuroraStore/-/work_items/1566

In my second reply I pointed out why even the asset store is not a source you can blindly trust. In my third reply I meant to point out that deflecting with the project being free software is largely irrelevant, not to mention that OP asked for feedback. The "doesn't matter" part was pulled out of thin air, I'll admit, but it was based on the dismissive reply to pikl ("It’s free software mate lol").

You can do whatever you want, but another person can use their free will to point out incorrect claims. In fact, in the age of disinformation, it's pretty important to look into claims (say, about safety and performance) made by people and projects, because they're not always to be trusted.

If you really want to get into it, since you are already trusting the author of the project you're pulling code from, you don't gain any security from pulling part of the code from another source. The benefit of your package manager is having to include less code in your git repository, potentially making it smaller, and (presumably) the ease of updating to a newer version.

And I don't know how you went from reading my comment to "screw yourself". Perhaps you should reconsider the way you handle entirely neutral and well-meant feedback.

Like pikl said, you made claims, so you can't just go "oh those don't matter because I'm not being paid". I wasn't demanding anything, I was just wondering if the claims held up. I'm just as much a hobby dev as you (by choice, in my case). We won't be able to do everything, satisfy everyone, finish every project, whatever it might be... but we can accept feedback all the same. And I'm glad you're considering mine.

I don't know how the official asset store works, but some software repositories allow re-uploading binaries under the same version, often for a legitimate reason. Relatedly, for example, Vintage Story released the same version twice for Linux, because the first time it had a broken install script. Everything else stayed the same. It broke the AUR package though and required a pkgrel bump.

A bug in the asset store could be exploited or it could be hacked, a popular asset silently replaced, and then you won't know if something changed. You mentioned decentralization, but if you wanna support other unofficial sources, then again you need to either trust them (and their security), or you could have a verification check like I mentioned.

I honestly prefer git submodules, but not every addon provides a readily cloneable repo (or branch).

What prevents bad actors from changing stuff under the hood? Pinning specific versions and verifying via checksum could be helpful here.

It's the swimsuit Poison Ivy skin.

Now, however, the ESRB has added “suggestive themes” to Fortnite’s rating, and that seems to be based on a single skin:

Players can encounter a female character depicted with deep inner cleavage and lower breast exposure.

This is clearly referring to the summer version of a Poison Ivy skin, a collaboration with DC that also featured swimsuit-wearing Harley Quinn, Catwoman and a swim trunks-wearing Bruce Wayne (mask on and off). And it’s true that Poison Ivy can probably be considered the most revealing skin in the game at the moment (though all of these are still miles below Marvel Rivals and certain none are R-rated)

30% is the industry standard across the board, with the exception of Epic which takes 12%. However, Epic has already shown that it's ready to dump loads of money into store exclusivity deals and tons of free games, so I will argue it's for the sake of growing the number of users and developers using their platform.

But do they, or any other competitor or similar store, offer the same functionality as Steam? rtxn already mentioned some. And there's more. And then there's the fact that Valve is using all that money not only to stuff the pockets of alread rich people (not that Gabe isn't a multi-millionaire if not billionaire, idk), but actually puts it back into the industry: Their own store, Linux/Proton (you may not care, but Microsoft becoming a monopoly in PC gaming is no good), and hardware (with their Steam Deck handheld, and VR stuffs).

Steam might be the biggest player when it comes to storefronts, but it's because they've actually earned it. And they're not actively preventing other competitors from entering the scene (other than existing). In fact, they keep trying, and keep failing, and then going back to Steam.

I'm not opposed to more money going to developers, but let's not single out Steam, who (perhaps besides GOG? I am not familiar enough with it) is doing the most for users and develpers.

There's been a hostile takeover at Gitea and it's now run / owned by a for-profit company. The developers forked the project under the name Forgejo and are continuing the work under a non-profit. See also: Their introduction post and a page comparing the two projects. Feel free to look up more, since I haven't familiarized myself with the incident all that much myself. Either way though, maybe consider using Forgejo instead of Gitea.