You must log in or # to comment.
… so ufw?
Inverted security by obscurity
Obscurity by security?
Sescurity by Obcurity
Obituary by Sorcery
Never trust an NPM library
bu-but so many libraries need funding!
Fuck node
… technical name for glory hole
OR
Your mom’s a fuck node
Doesn’t work like this.
Microslop is nervous now that Linux is popular enough to attack.
Linux has always been the bigger target. Even microslop uses linux for its severs.
They also have been developing a Linux distribution for 6 years. https://en.wikipedia.org/wiki/Azure_Linux
I’m gonna assume that their servers are not installing stuff from AUR though
I would hope so too
I avoid orphaned packages and I wait a few days before I type
yayIs there a flag to prevent orphaned packages from installing?
Good question, I guess I might be using the wrong word when i say “orphan” because I see the arch wiki uses that term differently
Orphans are packages that were installed as a dependency and are no longer required by any package.
You can remove these manually or if using an aur helper like yay there are flags/settings you can use to delete them after the desired package was installed.
However what I was talking about aur packages that are unmaintained or do not have a maintainer anymore.
I’m researching more at the moment.
shit, I had 150 orphaned packages
pacman -Qdtq | pacman -Rns -I made an alias for this, but IMO this cleanup should be automatic. The user didn’t install it themselves after all.
This can be prevented by uninstalling with -Rs
Just removing them without user intervention could cause unexpected behavior.
I don’t trust that everything that outputs from
pacman -Qdtqshould be deleted. Like I want to keepvlc.I think if you do pacman -S vlc it won’t be orphan anymore though. I removed everything, if I miss something I’ll install it again.
A simple install kept it orphaned. Instead I needed to run
sudo pacman -D --asexplicit vlc
You’re no fun
Waiting for updating doesn’t make any difference. The packages could be infected at any point.
The packages could be infected at any point.
I guess the same could be said for literally any open source or freely distributed project.
The difference is that this was a supply chain attack and, to my knowledge, required the package to be listed as
orphanedunmaintained first so that the PKGBUILD could be modified to install malicious NPM packages.The community caught it quickly because it is possible to read both the PKGBUILD and the output of the update and, I think, it is fully resolved as of now.
Basically, if one were to delete or replace orphaned packages then they wouldn’t have been infected.
It is also possible to add a CVE scanner for AUR packages if reading the PKGBUILD is too much, I’m looking into how to do that now.
All this is to say that you should check if you had an infected package but I personally don’t think using the aur is more risky than using a flatpak.
Waiting for updating doesn’t make any difference.
Are linux users allowed to juat lie like that? I thought if you do that you need to use Windows.
C’mon, man, at least pour one out for the homies who waited to update and landed in the period where it was live and undisclosed.
What?
They also wait until they get off the rollercoaster and back on solid ground before yelling
yay!
Linux Users: haha those silly windows users, always searching the web for their software and getting viruses.
Linux Users: oh no I got malware by searching the AUR!The AUR is still safer. One, it is at least minimally moderated. If a malicious package is detected, it can be reported and removed. Two, the installer is usually not just a black box executable. Three, most of the build and runtime dependencies are from the official Arch repos, which provides some protection against supply chain attacks. For Windows installers, you have to trust the distributor to bundle clean DLLs (for that matter, the same applies to AppImages).
But if it starts downloading anything from NPM… ^C and run.
The most unsafe factor of the AUR is aur helpers and their goal to dumb everything down and streamline the process as if the AUR where an official repo
Ye my reaction to this was basically uninstalling yay to force me to do it manually
I’m not entirely sure I agree, I think the issue is with default settings.
Like you could use both yay and paru to diff the PKGBUILD of the most recent updat and then read it, and then approve each. And I think that’s pretty helpful. But you could also just blindly accept the update with the right config or flag and that is not a good practice.
Yeah, use and promote
aurtoinstead. They require you to trust the maintainer and would remove the package from the local repo if the maintainer is changedI’m not sure if loosing the maintainer is to only thing we should be going off of here, but I like the name.
Well, it is just like a distro maintainer account anyway. If the maintainer account is compromised then gg for the whole distro. That’s what happens with other supply chain attacks as well and yes, I do think we need a way to fix that without compromising on ease of usability
We arnt talking about a distro maintainer, but an aur package maintainer, which can be anyone.
But Windows has a flourishing antimalware ecosystem. That’s missing in Linux imo
AUR naur! for all my Australians out there.
By misusing the AUR and ignoring every warning telling you to read and understand the pkgbuild or don’t do it.
Don’t worry, I found a package on npm to help!
btw, I use malware
Everyone knows if you use Kali you’re immune to malware
I don’t use Arch, BTW. So the biggest NPM threat vector on my machine is still VSCode.
I was anti GUI for years. Having learnt to program on a tiny green and black 40x24 CRT on my old MSX back in the 80s. I remember being made fun of by fellow students and co workers alike for doing almost everything in the terminal. This included huge projects with complex file trees and lots of files.
But as time went on, I started to appreciate the GUI more and more. And these days I’m all for using a GUI for a lot of things.
Especially in IDEs that can do a lot of things with short keyboard shortcuts. I now have multiple monitors, including a large 32" primary. I always have stacks upon stacks of windows open and manage them efficiently. There’s always at least a couple of terminals hanging out and of course most IDEs also have terminal windows baked in. But all of the extra visual tools help me out a lot.
Almost the exact opposite for me. Used to hog GUIs and hated keyboard shortcuts with a passion, but then I came across Niri, fell in love with the idea, and the whole scrolling window manager thing made my productivity explode. I can’t use traditional desktop environments anymore. Tried to go back and literally can’t.
Tmux wasn’t that far behind.
and the whole scrolling window manager thing…tmux wasn’t that far behnd
I remember one time reflecting on how many layers I have at which one can expand workspace.
-
Linux virtual terminals. By default, Debian runs 7 login sessions on seven virtual terminals and sticks the GUI (Wayland/Xorg) on the eighth. So Control-Alt-F1 through Control-Alt-F7 will get me a Linux terminal. I can stick more programs on more virtual terminals with
openvt. That’s the first layer. -
Okay, so on virtual terminal 8, I’ve got Wayland running. On that, I’m running Sway. That has an infinite number of workspaces that can be created. Currently, I only have bindings set up for 10 (and I use nonstandard bindings for them, Super-q N to switch to the Nth workspace) because I didn’t find myself actually using named workspaces. This is the second layer.
-
Within a workspace, I can have Wayland windows. Say I can have two or three windows reasonably visible. This can be expanded whenever opening a window; for example, Super-t to open a new virtual terminal emulator window. This is the third layer.
-
One of the most common windows I use is a virtual terminal emulator,
foot. That can run a program. I typically have it running tmux, which can have its own list of concurrently-running terminal programs (I use Control-O as the tmux meta key). This is the fourth layer. -
I often use emacs. Emacs has multiple “frames”; one can “clone” the current frame with
C-x 5 c. When run in a terminal, this basically acts like another tmux-like layer where one shows one frame at a time. This is the fifth layer. -
Inside an emacs frame, one can have multiple emacs windows (analogous to what is typically called “panes” in other software) showing various things at the same time. One can open a new window with
C-x 2orC-x 3, cycle withC-x o. This is the sixth layer. -
Emacs has a list of buffers, any one of which can be shown in a given emacs window. A “buffer” is vaguely analogous to “an open file” in some other programs, but could also be showing a terminal emulator or similar. One can switch with
C-x b. This is the seventh layer. -
Say I’m running a terminal emulator in one running
bash(M-x term RET RET).bashhas its own job control; one can suspend a running program and bring bash to the fore with Control-Z, list running jobs withjobs, then resume a suspended job in the background withbg %1to background the first or bring a job to the foreground withfg %1. This isn’t quite the same thing as the other layers, since the screen state isn’t maintained for separate programs and restored, but it can reasonably allow one to run simultaneous things and follow each. This is the eighth layer.
-
I’m a longtime vim user and I use nvim+lazyvim for all my personal stuff these days, but I have to use enterprise managed VS or VSCode for work.
I’m trying out Zed
ive been looking for an antivirus since i want to be able to download random stuff from the internet without having to review it
Clamav is pretty good if all you’re wanting to do is scan the files you’ve downloaded so that you’re not potentially re-transmitting viruses.
Outside of that, maybe consider using SELinux for security, or possibly if you’re going to be doing risky downloads, do it on a virtual machine, on a virtual network.
I’m trying Clamav but its giving me (at least what i think is) a bunch of false positives. I’ll look into SElinux.
Containerize or Virtualize whatever you plan to run, keep it volatile, otherwise you’ll have a host operating system riddled with unnecessary data.
Me!!!
But I’m actually safe: Last month I fried half of my BTRFS array, and decided that instead of recovering the system, I’d rather copy over the relevant data and reinstall Arch from scratch. In doing so, I’ve shed the majority of AUR packages that my old system had. Of the handful of AUR packages on my new system, none were attacked.
Also, an ad blocker.
With the old package managers safety was simple…trust the developers, user their packages. 10000 downloads? Easy! 1 download… 🤔 Maybe skip for now.
Now with executables like mac and Windows it’s easier to sneak something in. You still rely on trust. But now you’ve got AI in the game mudding the waters.
So… rkhunter?
