▲ 29 ▼ Prominent Arch Linux Developer Resigns After 10 Year Run (www.phoronix.com) submitted 2 months ago by steam_lover@sh.itjust.works to c/archlinux@lemmy.ml 12 comments fedilink hide all child comments
[+] marcie@lemmy.ml -6 points 2 months ago (9 children) when the AUR gets malware attacked for the 900th time permalink fedilink source hideshow 9 child comments replies: [–] Kazel@lemmy.dbzer0.com 5 points 2 months ago* (last edited 2 months ago) (7 children) don't use the aur if you can't read a PKGBUILD Edit: And Kids remember to always check the diff when updating permalink fedilink source parent hideshow 7 child comments replies: [–] delcaran@feddit.it 3 points 2 months ago (6 children) Reading PKGBUILD won't save you if you don't read the code or if the PKGBUILD installs a prebuilt bin. Same as Slackbuild or a third-party APT repository: you need to understand what a supply-chain attack is and do your duly work to prevent it, or stick with the consequences. permalink fedilink source parent hideshow 6 child comments replies: [–] Strit@lemmy.linuxuserspace.show 6 points 2 months ago (5 children) But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. It's a little harder with PPAs I think. The build files are not so easily found. permalink fedilink source parent hideshow 5 child comments replies: [–] victorz@lemmy.world 2 points 2 months ago (4 children) You never ever install a -bin package from the AUR? permalink fedilink source parent hideshow 4 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (3 children) Rarely, but I check the PKGBUILD to see if the binary is what I expect it to be. permalink fedilink source parent hideshow 3 child comments replies: [–] victorz@lemmy.world 1 point 2 months ago* (2 children) Yet, to quote: But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. permalink fedilink source parent hideshow 2 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (1 child) And you can check the shasum of the binary to see if it actually matches that provided by the developers of the application. A malicious PKGBUILD, which is what is being talked about, you would see that it downloads a binary that does not come from the developers and so you should not install that. If the attack happens on the developers repo, not even Linux repository packages would be safe at that point (eg, the xz heist). permalink fedilink source parent hideshow 1 child comment replies: [–] victorz@lemmy.world 3 points 2 months ago If the attack happens on the developers repo, not even Linux repository packages would be safe at that point I figured this is the type of attack you were referring to, but then you say you yourself don't really live by that safety measure. I don't either. I don't have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That's where I draw my line in the security sand. 😅 permalink fedilink source parent [–] ScoffingLizard@lemmy.dbzer0.com 1 point 2 months ago He was maintaining Arch packages. I think all of them were main repo materials. permalink fedilink source parent
[–] Kazel@lemmy.dbzer0.com 5 points 2 months ago* (last edited 2 months ago) (7 children) don't use the aur if you can't read a PKGBUILD Edit: And Kids remember to always check the diff when updating permalink fedilink source parent hideshow 7 child comments replies: [–] delcaran@feddit.it 3 points 2 months ago (6 children) Reading PKGBUILD won't save you if you don't read the code or if the PKGBUILD installs a prebuilt bin. Same as Slackbuild or a third-party APT repository: you need to understand what a supply-chain attack is and do your duly work to prevent it, or stick with the consequences. permalink fedilink source parent hideshow 6 child comments replies: [–] Strit@lemmy.linuxuserspace.show 6 points 2 months ago (5 children) But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. It's a little harder with PPAs I think. The build files are not so easily found. permalink fedilink source parent hideshow 5 child comments replies: [–] victorz@lemmy.world 2 points 2 months ago (4 children) You never ever install a -bin package from the AUR? permalink fedilink source parent hideshow 4 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (3 children) Rarely, but I check the PKGBUILD to see if the binary is what I expect it to be. permalink fedilink source parent hideshow 3 child comments replies: [–] victorz@lemmy.world 1 point 2 months ago* (2 children) Yet, to quote: But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. permalink fedilink source parent hideshow 2 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (1 child) And you can check the shasum of the binary to see if it actually matches that provided by the developers of the application. A malicious PKGBUILD, which is what is being talked about, you would see that it downloads a binary that does not come from the developers and so you should not install that. If the attack happens on the developers repo, not even Linux repository packages would be safe at that point (eg, the xz heist). permalink fedilink source parent hideshow 1 child comment replies: [–] victorz@lemmy.world 3 points 2 months ago If the attack happens on the developers repo, not even Linux repository packages would be safe at that point I figured this is the type of attack you were referring to, but then you say you yourself don't really live by that safety measure. I don't either. I don't have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That's where I draw my line in the security sand. 😅 permalink fedilink source parent
[–] delcaran@feddit.it 3 points 2 months ago (6 children) Reading PKGBUILD won't save you if you don't read the code or if the PKGBUILD installs a prebuilt bin. Same as Slackbuild or a third-party APT repository: you need to understand what a supply-chain attack is and do your duly work to prevent it, or stick with the consequences. permalink fedilink source parent hideshow 6 child comments replies: [–] Strit@lemmy.linuxuserspace.show 6 points 2 months ago (5 children) But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. It's a little harder with PPAs I think. The build files are not so easily found. permalink fedilink source parent hideshow 5 child comments replies: [–] victorz@lemmy.world 2 points 2 months ago (4 children) You never ever install a -bin package from the AUR? permalink fedilink source parent hideshow 4 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (3 children) Rarely, but I check the PKGBUILD to see if the binary is what I expect it to be. permalink fedilink source parent hideshow 3 child comments replies: [–] victorz@lemmy.world 1 point 2 months ago* (2 children) Yet, to quote: But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. permalink fedilink source parent hideshow 2 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (1 child) And you can check the shasum of the binary to see if it actually matches that provided by the developers of the application. A malicious PKGBUILD, which is what is being talked about, you would see that it downloads a binary that does not come from the developers and so you should not install that. If the attack happens on the developers repo, not even Linux repository packages would be safe at that point (eg, the xz heist). permalink fedilink source parent hideshow 1 child comment replies: [–] victorz@lemmy.world 3 points 2 months ago If the attack happens on the developers repo, not even Linux repository packages would be safe at that point I figured this is the type of attack you were referring to, but then you say you yourself don't really live by that safety measure. I don't either. I don't have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That's where I draw my line in the security sand. 😅 permalink fedilink source parent
[–] Strit@lemmy.linuxuserspace.show 6 points 2 months ago (5 children) But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. It's a little harder with PPAs I think. The build files are not so easily found. permalink fedilink source parent hideshow 5 child comments replies: [–] victorz@lemmy.world 2 points 2 months ago (4 children) You never ever install a -bin package from the AUR? permalink fedilink source parent hideshow 4 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (3 children) Rarely, but I check the PKGBUILD to see if the binary is what I expect it to be. permalink fedilink source parent hideshow 3 child comments replies: [–] victorz@lemmy.world 1 point 2 months ago* (2 children) Yet, to quote: But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. permalink fedilink source parent hideshow 2 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (1 child) And you can check the shasum of the binary to see if it actually matches that provided by the developers of the application. A malicious PKGBUILD, which is what is being talked about, you would see that it downloads a binary that does not come from the developers and so you should not install that. If the attack happens on the developers repo, not even Linux repository packages would be safe at that point (eg, the xz heist). permalink fedilink source parent hideshow 1 child comment replies: [–] victorz@lemmy.world 3 points 2 months ago If the attack happens on the developers repo, not even Linux repository packages would be safe at that point I figured this is the type of attack you were referring to, but then you say you yourself don't really live by that safety measure. I don't either. I don't have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That's where I draw my line in the security sand. 😅 permalink fedilink source parent
[–] victorz@lemmy.world 2 points 2 months ago (4 children) You never ever install a -bin package from the AUR? permalink fedilink source parent hideshow 4 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (3 children) Rarely, but I check the PKGBUILD to see if the binary is what I expect it to be. permalink fedilink source parent hideshow 3 child comments replies: [–] victorz@lemmy.world 1 point 2 months ago* (2 children) Yet, to quote: But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. permalink fedilink source parent hideshow 2 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (1 child) And you can check the shasum of the binary to see if it actually matches that provided by the developers of the application. A malicious PKGBUILD, which is what is being talked about, you would see that it downloads a binary that does not come from the developers and so you should not install that. If the attack happens on the developers repo, not even Linux repository packages would be safe at that point (eg, the xz heist). permalink fedilink source parent hideshow 1 child comment replies: [–] victorz@lemmy.world 3 points 2 months ago If the attack happens on the developers repo, not even Linux repository packages would be safe at that point I figured this is the type of attack you were referring to, but then you say you yourself don't really live by that safety measure. I don't either. I don't have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That's where I draw my line in the security sand. 😅 permalink fedilink source parent
[–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (3 children) Rarely, but I check the PKGBUILD to see if the binary is what I expect it to be. permalink fedilink source parent hideshow 3 child comments replies: [–] victorz@lemmy.world 1 point 2 months ago* (2 children) Yet, to quote: But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. permalink fedilink source parent hideshow 2 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (1 child) And you can check the shasum of the binary to see if it actually matches that provided by the developers of the application. A malicious PKGBUILD, which is what is being talked about, you would see that it downloads a binary that does not come from the developers and so you should not install that. If the attack happens on the developers repo, not even Linux repository packages would be safe at that point (eg, the xz heist). permalink fedilink source parent hideshow 1 child comment replies: [–] victorz@lemmy.world 3 points 2 months ago If the attack happens on the developers repo, not even Linux repository packages would be safe at that point I figured this is the type of attack you were referring to, but then you say you yourself don't really live by that safety measure. I don't either. I don't have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That's where I draw my line in the security sand. 😅 permalink fedilink source parent
[–] victorz@lemmy.world 1 point 2 months ago* (2 children) Yet, to quote: But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. permalink fedilink source parent hideshow 2 child comments replies: [–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (1 child) And you can check the shasum of the binary to see if it actually matches that provided by the developers of the application. A malicious PKGBUILD, which is what is being talked about, you would see that it downloads a binary that does not come from the developers and so you should not install that. If the attack happens on the developers repo, not even Linux repository packages would be safe at that point (eg, the xz heist). permalink fedilink source parent hideshow 1 child comment replies: [–] victorz@lemmy.world 3 points 2 months ago If the attack happens on the developers repo, not even Linux repository packages would be safe at that point I figured this is the type of attack you were referring to, but then you say you yourself don't really live by that safety measure. I don't either. I don't have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That's where I draw my line in the security sand. 😅 permalink fedilink source parent
[–] Strit@lemmy.linuxuserspace.show 4 points 2 months ago (1 child) And you can check the shasum of the binary to see if it actually matches that provided by the developers of the application. A malicious PKGBUILD, which is what is being talked about, you would see that it downloads a binary that does not come from the developers and so you should not install that. If the attack happens on the developers repo, not even Linux repository packages would be safe at that point (eg, the xz heist). permalink fedilink source parent hideshow 1 child comment replies: [–] victorz@lemmy.world 3 points 2 months ago If the attack happens on the developers repo, not even Linux repository packages would be safe at that point I figured this is the type of attack you were referring to, but then you say you yourself don't really live by that safety measure. I don't either. I don't have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That's where I draw my line in the security sand. 😅 permalink fedilink source parent
[–] victorz@lemmy.world 3 points 2 months ago If the attack happens on the developers repo, not even Linux repository packages would be safe at that point I figured this is the type of attack you were referring to, but then you say you yourself don't really live by that safety measure. I don't either. I don't have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That's where I draw my line in the security sand. 😅 permalink fedilink source parent
[–] ScoffingLizard@lemmy.dbzer0.com 1 point 2 months ago He was maintaining Arch packages. I think all of them were main repo materials. permalink fedilink source parent