Please tell your friends about federated social media site that speaks several fediverse protocols thus serving as a hub uniting them, hubzilla.eskimo.com, also check out friendica.eskimo.com, federated
macroblogging social media site, mastodon.eskimo.com a federated microblogging site, and yacy.eskimo.com an uncensored federated search engine. All Free!
On the 16th of July, at around 8pm UTC+2, a malicious AUR package was uploaded to the AUR. Two other malicious packages were uploaded by the same user a few hours later. These packages were installing a script coming from the same GitHub repository that was identified as a Remote Access Trojan (RAT).
The affected malicious packages are:
librewolf-fix-bin
firefox-patch-bin
zen-browser-patched-bin
The Arch Linux team addressed the issue as soon as they became aware of the situation. As of today, 18th of July, at around 6pm UTC+2, the offending packages have been deleted from the AUR.
We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised.
Follow up
There are more packages with this malware found.
minecraft-cracked
ttf-ms-fonts-all
vesktop-bin-patched
ttf-all-ms-fonts
What to do
If you installed any of these packages, check your running processes for one named systemd-initd (this is the RAT).
The arch maintainers package more software than most other distributions. Some items they leave in the AUR by choice, if the Dev prefers it there. The key is to use the AUR sparingly and only if you trust the packager.
The arch maintainers package more software than most other distributions.
Sorry, but I fail to see this.
I suppose if you're accounting literally all independent distros, then you're probably right. However, if we'd be more realistic and compare it to other well-established independent distros^[I'm basically counting Alpine, Debian, Fedora, Gentoo, openSUSE, Slackware, Solus and Void. I didn't count Guix System and NixOS for how their 'repositories' are built different and therefore not easily comparable to the others.], then we notice that the vastness of the packages found in Arch's repository is rather lackluster at the very least. Heck, by virtually all metrics, Arch together with its derivatives undoubtedly belong in the upper echelons of usage stats; only being second to the Debian-family of distros. IMO, however, the size of its repository absolutely doesn't reflect this; as it's only bigger than Slackware, Solus and Void. The inclusion of these smaller projects is arguably charitable on my side*. But to drive the point home very clearly: Arch's repository is smaller than Alpine's, Debian's, Fedora's, openSUSE's and Gentoo's with a ratio of (about) two to one (except for openSUSE).
I don't know if raw package counts is the best comparison. Unlike say Fedora, Arch bundles everything related to a project in the same file. If you want Qt6-base on Arch, that is one package. If you want it on Fedora, it is going to have a lib, header, docs, and maybe a few other packages.
Just from personal experience, I do not have issues with finding packages in the main repos, with only a handful of my packages coming from the AUR. This is not the case with others, like Fedora where extra repos need to be added, like EPEL and RPM Fusion.
I don't know if raw package counts is the best comparison.
You're probably right. Do you think we got anything better to go by?
Unlike say Fedora, Arch bundles everything related to a project in the same file. If you want Qt6-base on Arch, that is one package. If you want it on Fedora, it is going to have a lib, header, docs, and maybe a few other packages.
Can't comment on this. Though, the list of packages with qt6 in their name is considerably longer in Fedora. However, I wonder if this simply reflects that Fedora, by virtue of having a larger repository, also has more stuff related to qt6. Or, as you posited it, chooses to package the same content over multiple packages instead of bundling them like it's supposedly happening on Arch.
Just from personal experience, I do not have issues with finding packages in the main repos, with only a handful of my packages coming from the AUR. This is not the case with others, like Fedora where extra repos need to be added, like EPEL and RPM Fusion.
Hmm..., I feel you might be conflating stuff. Please allow me to elaborate on what I mean.
Fedora is not able to include some packages in its own repository due to legal reasons. As such, these are relayed to RPM Fusion instead. Which means that a well-functioning Fedora installation (almost necessarily) desires to install some packages from RPM Fusion. So, RPM Fusion exists as a 'hack' of sorts to protect Fedora from legal charges and NOT because they're too lazy (or something) to ship those packages themselves. To be clear, RPM Fusion is accepted as a trusted third-party repository.
Arch, on the other hand, is rather lenient on what they can include in their repositories. Basically enabling them to package within their repositories all codecs and whatnot without them being visibly worried about the legal consequences of this ordeal.
To be honest, I don't know exactly where this discrepancy comes from. But I wouldn't be surprised if it's related to how Arch is basically a genuine community distro while Fedora has official ties to Red Hat.
I 100% agree. Everyone raves about the AUR but it really feels like more of a necessity than a value add because so little is actually packaged for arch. And the AUR is definitely more annoying and feels more jank than just having it in your default repo.
It has already happened a few times with other repos. Although AUR is especially susceptible because there's no vetting at all, it's a free-for-all that everyone can publish to within a few clicks. This will for sure happen again within a couple months, but better hidden the next time.
The Arch User Repository is a way for anyone to easily distribite software.
Hence it has never been secure, and rather than claim it is, you mostly see people and documentation warn you about this, and to be careful if using it.
Any schmuck can make whatever they want available via the AUR. That's how even the tiniest niche project can often be installed via the AUR. But you trade in some security for that convenience.
What a nice attack on privacy-friendly infrastructure.
And then, Arch AUR has such suspicious things like the Brave browser which claims to reduce tracking.... and works together with advertisers.
To be clear, AUR is fantastic if you develop some experimental package and you want to give it to your friends to try it out easily. But not as a general distribution mechanism.
Wait what happens once some government or state actor hacks rust's install script rustup with its curl | bash install procedure and relying on TLS certificates which are e.g. issued by the Russian government. (No, the rust project won't use a Russian/Chinese/US Gov certificate but your browser will trust near all of them...)
You're using that to download a program. If they can MitM the shell script, they can just as well MitM the program that you'll run right after the download...
Sure, I guess, if you've got a distro installed on your PC and use the distro-provided packages to install the Rust compiler, then you can't be subject to such certificate MitM attacks.
Your comment sounded like you were primarily concerned about the shell script piping rather it just being a program which can be downloaded without going through distro packages.
Your comment sounded like you were primarily concerned about the shell script piping rather it just being a program which can be downloaded without going through distro packages.
The AUR install scripts are just downloaded shell scripts which are executed (hopefully after inspection).
curl | bash just skips the inspection step - curl downloads to stdout, bash executes from stdin.
We are getting to the point where inviting more people in means we will need an automated babysitter to watch for this shit and to pull it once it’s discovered. Apple has a walled garden approach that’s certainly taken a big chunk of malware threats out of their devices but their walled garden approach is ridiculous and impractical for Linux. The Microsoft method of monitoring and second guessing everything with antimalware programs is also suspect because it is super easy to abuse and resource intensive. We have clamAV but clam kinda sucks.
Linux is at the point where we need something that audits what’s going in and automatically yanks it back out remotely if it’s found to be a problem. Things can only be added by the user, but the bot can remove them without interaction of the user.
I don’t see this happening though. Instead, I see this as more of a rust vs C thing all over again, where valid critiques are drowned out by “improve your skills bro.”
Gotta assume that if any Arch users actually fell for that one, that they either let their kids use their device or they're generally not smart ( which absolutely goes against my stereotypical view of an arch user ).
The stereotype of arch uses generally being smart is no longer. The "I use arch btw" meme brought a whole new user base to arch. You'll find them on r/unixporn showing off their hyperland rice that they copied from some other user..
I had no idea that existed but I’ve just returned from r/unixporn. There are some sick setups. Also we all copy. My entire neovim config is copied and modified from a couple dozen setups I admired. Nothing wrong with copying things you like. Don’t gate keep Linux.
"... Most certainly America is under attack, including from foreign enemies behind the scenes. But it’s not just from foreign enemies. We are under attack from a home-grown army of Marxist ideologues who have been inspired by college and university professors, and by Barack Hussein Obama and others of his ilk within the Democrat Party.
They are fully committed to their cause, which is the overthrow of our Constitutional
Republic. So we better damn-well be even more committed to preserving and protecting this nation against all of our enemies. Both foreign, and from the subversives within."
- Shock people - Sensationalism - Cuteness - Laugh at misfortune - Gossip - Say something polarizing - Say something that allows people to excuse themselves or blame someone/something else for problems - Say something agreeable that people can latch on to and say "THIS!"
It's hard to truly develop ones self or find peace, when drowning in a sea of mind-pollution.
Avoid platforms that support it, use a 3rd-party client, and curate.
While I left most of the major social media platforms and distracting apps, with the parts of the Internet I still look at, it can feel like a fine line between browsing to learn something useful or important vs just being distracted and stirring up my mind
Where to draw the line?
I think intention comes into it - both my intention when browsing AND the intention of people making content. Being sensitive and mindful of both, and using that to guide me
Wenn es so etwas wie investigativen Journalismus gäbe, wäre seine große Aufgabe die Durchdringung des Dschungels der NGOs. Stattdessen wehrt man sich gegen die 551 Fragen. #GNGO #NGO
Tracking Canada’s fascist fight clubs
CBC’s visual investigations team reveals where some of Canada’s white nationalist 'active clubs' gather to prepare for violence.
The light on the moss and fallen leaves, the silence, a gently wafting breeze. Sometimes it pays to take those few extra steps to see where that path off to the side leads.
1. In a recent submission to the UN, a special Rapporteur Reem Alsalem, an anti-trans extremist appointed by the UN but not representing its views, claimed being transgender was contagious. It is not. A fact check from our writer, S. Baum. Subscribe to support our journalism.
2. Anti-trans extremists are once again circulating viral claims that being transness is a “social contagion” after an independent human rights expert, appointed by but not representing the official stances of the United Nation, in a submission to the UN. x.com/robjessel16/...
3. These sensationalized stories use junk science and outdated myths about sex and gender as an excuse to hinder trans kids’ access to life-saving care. Multiple studies have undercut the “social contagion” claim. fenwayhealth.org/new-study-un...
BOSTON, March 20, 2023—A study published in the Journal of Adolescent Health found that a substantial proportion of transgender and gender diverse (TGD)
4. But the “social contagion” scare is one we’ve seen before with LGBT communities. Conservative groups and politicians have spent a lifetime pushing the homophobic myth that being gay is merely the product of social conditioning; that it is a deviant behavior that can and should be snuffed out.
5. As the famously homophobic televangelist Pat Robertson stated over a decade ago, “a person who has acquired this can un-acquire it”—”it” being same-sex attraction. www.phillymag.com/news/2011/12...
6. Nonetheless, some have tried, and failed, to meaningfully reaffirm this belief. Enter Dr. Lisa Littman: A disgraced researcher who coined the term “rapid onset gender dysphoria” during a 2016 study as a way to formalize and pathologize the idea that transness is a “social contagion.”
7. Littman failed to disclose that participants were largely recruited from anti-trans online forums. As a result, the journal issued a correction. Other scientists that tried to verify ROGD stumbled upon similar academic impropriety, and at least one other article was retracted.
8. As the trans “social contagion” panic about trans people proliferates today in the form of state, federal and international attacks, at least one thing has become clear: This vestige of hate never really went away to begin with.
News and discussion on trans legislation and life. Click to read Erin In The Morning, by Erin Reed, a Substack publication with hundreds of thousands of subscribers.
Do folks outside the US understand the whole domestic vs. Mexican soda thing? It's kinda funny because a hallmark of a legit taco place is they keep some Mexican Pepsi around and everyone is like "oh, it's so much better because it's made with cane sugar instead of corn syrup". And if they've got Jarritos, it's like, did I just get transported to Cancun?
my northern friends are so impressed we can get Mexican Topo Chico, straight from Monterrey in glass bottles. The chonky half liter ones too.
It's not the sugar that makes those great, it's the incredible effervescence. You can leave one open, go on vacation, come back, and it's still got bite.
Department of Homeland Security Secretary Kristi Noem snapped at a reporter Friday during a press conference in Nashville, Tennessee for asking a question over alleged racial profiling during immigration raids.
They expect us to swallow this sudden “transparency” like it’s honesty—when it’s just the latest PR diaper strapped to a man who’s been leaking lies since the ‘70s.
When even MAGA’s most loyal conspiracy peddlers turn on Trump over the Epstein files, it’s not justice they crave; it’s revenge for being played like fools.
It is a classic meme and I love it too, but I can't help myself: should be " . . . but you'll never be as cool as this Mongolian Shepard with his AK-74 . . ." Big ass compensator at the end of the barrel is the give away: AK-74 in 5.45x39mm (basically an AK-47 firing a necked down round for a smaller bullet with higher velocity, parallel to the western 5.56x45mm) en.wikipedia.org/wiki/AK-74
Biciosxs, divendres, 25 de juliol, a les 18:00 CEST
Biciosxs - Bikearka és un taller autogestionat d'autoreparació de bicicletes que funciona sense diners. El taller posa els coneixements, recanvis eines necessaries per tal que les usuàries puguin, elles
Jul25
biciosxs - taller autogestionat d’autoreparació de bicicletes
Biciosxs - Bikearka és un taller autogestionat d'autoreparació de bicicletes que funciona sense diners. El taller posa els coneixements, recanvis eines necessaries per tal que les usuàries puguin, elles mateixes, aprendre i arreglar-se la seva bicicleta!
'Google Gemini decided to call off a chess match against the ancient 1.19 MHz Atari 2600 console after a friendly pre-game reminder about what happened to ChatGPT and Microsoft’s Copilot.'
'Gemini must have then thought a bit deeper about what exactly would be involved in the chess challenge, and admitted to Caruso that it had been hallucinating regarding the magnitude of its abilities. It added that it now felt that it would “struggle immensely” in a match against the Atari 2600.'
My father is 84 years old. He had leukemia and then came double-lung pneumonia. He was so close to death, the doctors discharged him to hospice with only a week or two to live. But I wasn’t ready to let go. And more importantly ~ neither was he. I was with him every day. I brought herbs. Green
juices. LifeWave patches. Prayer. And presence. I read aloud every letter, every message from the many hearts his life has touched over the years. And slowly, something began to shift. He got stronger. Not in some sudden, dramatic leap ~ but in the quiet, steady, undeniable return of life force. Hospice moved him to a longer-term bed, thinking he might hold on for a few more months. But day by day, he rose. He baffled doctors and hospice workers alike. They called it a miracle. I just ...
call it love, Spirit, the intelligence of the body when supported by truth. He was discharged home. He drives, goes to concerts, talks with me daily, & recently, when a new doctor’s suggestion could have set him back, he called me first. And then told his nurse: “I listen to my daughter now, not my doctors.” He sounds so good. So alive. This is not just a story of healing. This is proof of what’s possible ~ when we start returning to the wisdom of the Earth, the soul, & the ...
"Abu Ubaida, the spokesperson for Al-Qassam Brigades, warned Friday that Hamas will not return to the formula of partial prisoner exchanges or the “10 prisoners” proposal if Israel fails again in the current round of negotiations" “They are not interested in their prisoners. They have already prepared their public to accept their death,” Abu Ubaida said “To the world: silence is complicity.”
Gaza (Quds News Network)- Abu Ubaida, the spokesperson for Al-Qassam Brigades, warned Friday that Hamas will not return to the formula of partial prisoner exchanges or the "10 prisoners" proposal if I
Israel have shown time and again that they would rather RESCUE the hostages once they are dead under rubble They could have had their hostages back day one if they wanted but it looks good to the media if hamas has them And what about the thousands of Palestinian hostages abused in israel jails?
@Sable_Shade Sadly for #IsraelTerroristState the hostages have more value dead than alive. Dead means more rage inside Israel society (yes I mean #USrael too) This is the reality of that sick society.
Renowned for the world’s tallest trees, Redwood’s landscapes span from open prairies and oak woodlands to pristine rivers and untamed coastline. This ancient home has supported people for thousands of years.
We went on Camas Infoshop's podcast to talk about InterRebellium, the 2020 ShutDownCanada movement, and the role of anarchist media in pushing for liberation.
subMedia is an anarchist digital media collective. First established in 1994, subMedia has produced hundreds of videos on everything from urban insurrectiona...
"As Naomi Klein writes in _Doppelganger_, the right lives in a 'mirror world' where child abuse is confined to largely imaginary children in nonexistent pizza parlor basements, while actual kids in Florida concentration camps, or border detention cages, or meat-packing plant night shifts, or living in hunger and without a home, are ignored." — @pluralistic
"Trump's lifelong strategy has been to race across a succession of rivers on the backs of alligators without losing a leg. He is the undisputed all-time historical champion of this bizarre sport, but no one can win that race forever, and your first loss is a career-ender." — @pluralistic
"This is as Rick Perlstein prophesied a year ago: these groups [Trump supporters] hate each other and the only way for some of them to get what they want is for others to be totally betrayed." — @pluralistic
Black: It represents mourning and sadness over the injustice and persecution suffered by the Palestinian people. It symbolizes the darkness that surrounds the homeland and the silence that prevails over children's laughter; White: Symbolizes peace and love, echoing the messages of the prophets. It reflects the desire for hearts free of hatred, as opposed to enemies who carry only malice; Green: It represents goodness, growth, blessings, and hope for the future. It symbolizes Palestine's potential for prosperity and flourishing, with the expectation that the barren land will once again become fertile and joyful; Red: signifies martyrdom, sacrifice and devotion. It is associated with the honor of giving one's life in defense of religion, family and country.
Theme song for when a British gentleman, accompanied by a Polish lady knight, several adventurous treasure hunters, and a few local Chinamen must slay the ravenous and evil dragon spirit of Gluttony, the final boss to his expedition to China. (Chinamen must learn to be gluttonous not for food but for opium and the other wonderous medical concoctions that His Majesty is delighted to sell to his new yellow friends at totally reasonable market prices. And they must learn this lesson by force, if need be. Indeed, the lesser yellow man often can understand no language BUT force! (Turns out knights are just as good at slaying eastern dragons as they are western. Even the girl knights seem to do almost half as decent as the men.))
Arknights Side Story - Such is the Joy of Our Reunion Original SoundtrackMonster Siren Records: https://monster-siren.hypergryph.com℗ Shanghai Hypergryph Net...
@hazlin a significant chunk of my playlist is just Arknights music. If nothing else the game is good at giving us a couple banger songs every month or so as well as lengthy stories about, say, food, reconnecting with lost family, and how sacrifice is both terrible for both victim and those left behind but also sometimes necessary, reflected across three different stories across the dozen or so different characters.
Hopped on my bicycle today and after a couple of spins around the parking lot I decided to head down the Greenbelt in town. I didn't fall over, but I was a bit shaky riding along as it's been about 45 years since I rode. A big fuck you to the Canadian geese that thought it was a good idea to stroll out into the path and just stand there blocking my way. I managed to do just under 6 miles, relatively flat, but it felt good, and I did have some jelly legs when I finished my ride.
Wow...Epstein has him on the defensive. A canny move against future trials? Perhaps--hope they all get along with better lives. Maybe he'll do something bizarre just to "own the libs" by pushing Medicare-for-All next. (Haha.) Of course queries: is this ALL of them? And where are they sent/can we believe this?
In a massive prisoner swap deal, the Trump administration got over 200 Venezuelan migrants he deported to an infamous Salvadoran megaprison released in exchange for the Venezuelan government releasing 10 American citizens and permanent residents who …
The age of artificial intelligence (AI) has transformed our interactions, but threatens human dignity on a worldwide scale, according to a study led by Charles Darwin University (CDU).
So people in our local community think its funny to now stalk peoples homes without a detective badge and actually certified or they choose to become an out of uniform kkkop to stalk people, how can society be accepting of this type of behaviour?!
@Scrawly The orca whales refer to a 2020 incident known as the "Orca Wars" or "Iberian orca attacks," during which a subpopulation of orca whales (or killer whales) were documented attacking boats in Spain and Portugal, many of which were yachts. There are no reports that they killed any CEOs, but as far as the meme is concerned, it presumes some were owned by CEOs.
Zelda plays Retro Games, YTP Watch Parties, assorted silly content reactions, Indie and general gaming content. Chill vibes, no BS, lots of different games. VODs and more on YT: https://www.youtube.com/@TheZeldaZone
It’s not that sex is sin, foe of moral purity, or euphoric nature’s gifts oppose All That Is Holy. Oligarch profit model controls labor through onus of dependents; coital relations must issue descendants.
Exactly. If it doesn't affect you and you can opt-out, mind your own fucking business.
Nobody's making you buy porn games. Nobody's making you watch them play porn games. You can filter out porn games if you don't want to see them. And after using it for three sentences in a row, the phrase "porn games" doesn't even feel like it even means anything anymore.
Nobody's making you hire sex workers. You can say "no thank you" if a sex worker propositions you in exactly the same way that you can say no if someone who *isn't* a sex worker propositions you. Although, there is actually at least one difference between those situations - sex workers are much more likely to take no for an answer.
I mean, goddamn, if only these people cared about the fact that people do sex at each other as little as they care about the unhoused.
I 100% agree and the gradual normalisation and acceptance of Puritanism and thoughts within my generation, inc the majority of people at my uni (which is well known to be very progressive) has been really rather disappointing to say the least. Esp as we were seen a few years back to be challenging societal norms and now it just seems like we are reverting back everything. 🙁
Although saying that, respectability should not be confused with being polite, accepting and treating people how you want to be treated is a good thing to do and the thing people should expect in general, though don’t use that as a way to be vindictive or nasty to people in general, and if so, it’s also perfectly valid to call people out on their shitty behaviour.
Besides, as much as I hate to use a "slippery slope" argument, the fact is, today they're blocking just low grade shovelware games, tomorrow they'll be blocking some really wonderful indie game that simply dared to mention something they don't like. It's not really a logical fallacy when it's a thing that actually has happened and which logically we know will happen.
Dear reader: there's a few trolls in the comments of OP asking questions and trying to stir the pot. Don't engage. Block and move on. These people don't want their minds changed, they want to sow chaos (much like the puritanical sort, come to think of it).
Former President of the United States Barack Obama sits down with Michelle and Craig to answer a listener’s question about raising emotionally intelligent yo...
""Crowds stood outside the Juanita Kidd Stout Center for Criminal Justice chanting “say it loud, say it clear, immigrants are welcome here.”The Friday morning rally organized by Juntos follows a string of Immigration and Customs Enforcement detainments outside courthouses, including one at the Philadelphia justice center earlier this week, raising concerns among the community." inquirer
Director of National Intelligence Tulsi Gabbard on Friday released an earth-shattering report detailing how federal agencies under the Obama administration...
It’s fun! This one was everything that traditionally happens at a summer weekend gathering by the sea, but with real, community-level politics. If you walk along to the west end of Hastings seafron…
Tundra
in reply to Xylight • • •Mwa
in reply to Tundra • • •Mwa
in reply to Xylight • • •Voytrekk
in reply to Mwa • • •pyssla
in reply to Voytrekk • • •Sorry, but I fail to see this.
I suppose if you're accounting literally all independent distros, then you're probably right. However, if we'd be more realistic and compare it to other well-established independent distros^[I'm basically counting Alpine, Debian, Fedora, Gentoo, openSUSE, Slackware, Solus and Void. I didn't count Guix System and NixOS for how their 'repositories' are built different and therefore not easily comparable to the others.], then we notice that the vastness of the packages found in Arch's repository is rather lackluster at the very least. Heck, by virtually all metrics, Arch together with its derivatives undoubtedly belong in the upper echelons of usage stats; only being second to the Debian-family of distros. IMO, however, the size of its repository absolutely doesn't reflect this; as it's only bigger than Slackware, Solus and Void. The inclusion of these smaller projects is arguably charitable on my side*. But to drive the point home very clearly: Arch's repository is smaller than Alpine's, Debian's, Fedora's, openSUSE's and Gentoo's with a ratio of (about) two to one (except for openSUSE).
DistroWatch.com: Put the fun back into computing. Use Linux, BSD.
distrowatch.comVoytrekk
in reply to pyssla • • •I don't know if raw package counts is the best comparison. Unlike say Fedora, Arch bundles everything related to a project in the same file. If you want Qt6-base on Arch, that is one package. If you want it on Fedora, it is going to have a lib, header, docs, and maybe a few other packages.
Just from personal experience, I do not have issues with finding packages in the main repos, with only a handful of my packages coming from the AUR. This is not the case with others, like Fedora where extra repos need to be added, like EPEL and RPM Fusion.
pyssla
in reply to Voytrekk • • •Thank you for the quick response!
You're probably right. Do you think we got anything better to go by?
Can't comment on this. Though, the list of packages with qt6 in their name is considerably longer in Fedora. However, I wonder if this simply reflects that Fedora, by virtue of having a larger repository, also has more stuff related to qt6. Or, as you posited it, chooses to package the same content over multiple packages instead of bundling them like it's supposedly happening on Arch.
Hmm..., I feel you might be conflating stuff. Please allow me to elaborate on what I mean.
Fedora is not able to include some packages in its own repository due to legal reasons. As such, these are relayed to RPM Fusion instead. Which means that a well-functioning Fedora installation (almost necessarily) desires to install some packages from RPM Fusion. So, RPM Fusion exists as a 'hack' of sorts to protect Fedora from legal charges and NOT because they're too lazy (or something) to ship those packages themselves. To be clear, RPM Fusion is accepted as a trusted third-party repository.
Arch, on the other hand, is rather lenient on what they can include in their repositories. Basically enabling them to package within their repositories all codecs and whatnot without them being visibly worried about the legal consequences of this ordeal.
To be honest, I don't know exactly where this discrepancy comes from. But I wouldn't be surprised if it's related to how Arch is basically a genuine community distro while Fedora has official ties to Red Hat.
Btw, small correction, AFAIK you're not supposed to install packages from the EPEL on Fedora. Perhaps you meant COPR (basically Fedora's AUR) or Terra instead?
Getting started with EPEL
Fedora DocsMwa
in reply to Voytrekk • • •facow [he/him, any]
in reply to Mwa • • •hobbsc
in reply to Xylight • • •lagoon8622
in reply to hobbsc • • •hobbsc
in reply to lagoon8622 • • •lagoon8622
in reply to hobbsc • • •balsoft
in reply to hobbsc • • •Ulrich
in reply to Xylight • • •So...did someone just like create a new package cloning these or did they somehow get into the "official" repository? Is there no attestation process?
Jolteon
in reply to Xylight • • •MentalEdge
in reply to Jolteon • • •Absolutely.
The Arch User Repository is a way for anyone to easily distribite software.
Hence it has never been secure, and rather than claim it is, you mostly see people and documentation warn you about this, and to be careful if using it.
Any schmuck can make whatever they want available via the AUR. That's how even the tiniest niche project can often be installed via the AUR. But you trade in some security for that convenience.
HaraldvonBlauzahn
in reply to Xylight • • •What a nice attack on privacy-friendly infrastructure.
And then, Arch AUR has such suspicious things like the Brave browser which claims to reduce tracking.... and works together with advertisers.
To be clear, AUR is fantastic if you develop some experimental package and you want to give it to your friends to try it out easily. But not as a general distribution mechanism.
HaraldvonBlauzahn
in reply to Xylight • • •curl | bashinstall procedure and relying on TLS certificates which are e.g. issued by the Russian government. (No, the rust project won't use a Russian/Chinese/US Gov certificate but your browser will trust near all of them...)Ephera
in reply to HaraldvonBlauzahn • • •HaraldvonBlauzahn
in reply to Ephera • • •wewbull
in reply to HaraldvonBlauzahn • • •Ephera
in reply to HaraldvonBlauzahn • • •Sure, I guess, if you've got a distro installed on your PC and use the distro-provided packages to install the Rust compiler, then you can't be subject to such certificate MitM attacks.
Your comment sounded like you were primarily concerned about the shell script piping rather it just being a program which can be downloaded without going through distro packages.
HaraldvonBlauzahn
in reply to Ephera • • •The AUR install scripts are just downloaded shell scripts which are executed (hopefully after inspection).
curl | bashjust skips the inspection step - curl downloads to stdout, bash executes from stdin.muusemuuse
in reply to Xylight • • •We are getting to the point where inviting more people in means we will need an automated babysitter to watch for this shit and to pull it once it’s discovered. Apple has a walled garden approach that’s certainly taken a big chunk of malware threats out of their devices but their walled garden approach is ridiculous and impractical for Linux. The Microsoft method of monitoring and second guessing everything with antimalware programs is also suspect because it is super easy to abuse and resource intensive. We have clamAV but clam kinda sucks.
Linux is at the point where we need something that audits what’s going in and automatically yanks it back out remotely if it’s found to be a problem. Things can only be added by the user, but the bot can remove them without interaction of the user.
I don’t see this happening though. Instead, I see this as more of a rust vs C thing all over again, where valid critiques are drowned out by “improve your skills bro.”
oo1
in reply to Xylight • • •I already assumed aur was riddled with stuff like that.
Use a condom when fucking around in there.
AceFuzzLord
in reply to Xylight • • •Gotta assume that if any Arch users actually fell for that one, that they either let their kids use their device or they're generally not smart ( which absolutely goes against my stereotypical view of an arch user ).
pfr
in reply to AceFuzzLord • • •moseschrute
in reply to pfr • • •I had no idea that existed but I’ve just returned from r/unixporn. There are some sick setups. Also we all copy. My entire neovim config is copied and modified from a couple dozen setups I admired. Nothing wrong with copying things you like. Don’t gate keep Linux.
However… Minecraft cracked is pretty funny lol.
lattrommi
in reply to moseschrute • • •I agree that gatekeeping is no good and people should not do that.
However...
I do not feel that assuming all people copy, should be done either, in my opinion.
pfr
in reply to lattrommi • • •lattrommi
in reply to pfr • • •I don't know if there is a word for what I was trying to point out.
Like an opposite to gatekeeping, sort of.
I do not like when people use 'we', in ways that include people that it does not apply to. Lumping everyone together inaccurately into a group.
teawrecks
in reply to Xylight • • •redxef
in reply to Xylight • • •With
vulnerable_packages.txtcontaining one package name per line.Matt
in reply to Xylight • • •TLauncher — Download Minecraft Launcher
TLauncher