top 91 comments

sorted by: hot top controversial new old
[โ€“] 120 points 4 months ago (3 children)

Never trust an NPM library

  • source
  • hideshow 3 child comments
  • [โ€“] 54 points 4 months ago

    btw, I use malware

  • source
  • [โ€“] 46 points 4 months ago (4 children)

    I don't use Arch, BTW. So the biggest NPM threat vector on my machine is still VSCode.

  • source
  • hideshow 4 child comments
  • [โ€“] 7 points 4 months ago (2 children)
  • [โ€“] 80 points 4 months ago (2 children)

    The more popular Linux becomes, the less true this will be.

  • source
  • hideshow 2 child comments
  • [โ€“] 30 points 4 months ago* (last edited 4 months ago) (8 children)

    I avoid orphaned unmaintained packages and I wait a few days before I type yay

  • source
  • hideshow 8 child comments
  • [โ€“] 6 points 4 months ago (5 children)

    Is there a flag to prevent orphaned packages from installing?

  • source
  • parent
  • hideshow 5 child comments
  • [โ€“] 7 points 4 months ago* (4 children)

    Good question, I guess I might be using the wrong word when i say "orphan" because I see the arch wiki uses that term differently

    Orphans are packages that were installed as a dependency and are no longer required by any package.

    https://wiki.archlinux.org/title/Pacman/Tips_and_tricks

    You can remove these manually or if using an aur helper like yay there are flags/settings you can use to delete them after the desired package was installed.

    However what I was talking about aur packages that are unmaintained or do not have a maintainer anymore.

    I'm researching more at the moment.

  • source
  • parent
  • hideshow 4 child comments
  • [โ€“] 6 points 4 months ago (3 children)

    shit, I had 150 orphaned packages

    pacman -Qdtq | pacman -Rns -

    I made an alias for this, but IMO this cleanup should be automatic. The user didn't install it themselves after all.

  • source
  • parent
  • hideshow 3 child comments
  • [โ€“] 2 points 4 months ago (2 children)

    I don't trust that everything that outputs from pacman -Qdtq should be deleted. Like I want to keep vlc.

  • source
  • parent
  • hideshow 2 child comments
  • [โ€“] 28 points 4 months ago (6 children)

    I never had any issues on TempleOS.

  • source
  • hideshow 6 child comments
  • [โ€“] 26 points 4 months ago (3 children)

    Zero remote exploits since it was released. That's what divinely-inspired coding looks like, everyone.

  • source
  • parent
  • hideshow 3 child comments
  • [โ€“] 11 points 4 months ago* (1 child)

    Out of curiosity, is that actually true? Surely our lord and saviour must have made a tiny slip-up

    Edit: Apparently TempleOS doesn't have networking

  • source
  • parent
  • hideshow 1 child comment
  • [โ€“] 11 points 4 months ago* (last edited 4 months ago)

    It is networked >!to Gฬทอ€ฬƒฬŽฬŒฬ—ฬ™อšฬฅอ“ฬผฬ ฬฉอ™oฬทฬฬ…อ„อŠฬŒอ€ฬอŒฬฝอˆฬญฬชฬฎฬอšฬจฬŸฬนฬญฬคอ‡อ•ฬชฬขdฬทฬ‚ฬฝฬ”ฬšฬพอ ฬ“ฬ‹อ˜ฬฎอ•อ‰ฬฅฬก!<

  • source
  • parent
  • [โ€“] 18 points 4 months ago (6 children)

    ClamAV users, how's it going?

  • source
  • hideshow 6 child comments
  • [โ€“] 2 points 4 months ago (2 children)

    I am really curious about this. If someone had ClamAV and updated any of these packages from the AUR during the attack, would ClamAV have "solved" that problem? I would love to know the effectiveness of that.

  • source
  • parent
  • hideshow 2 child comments
  • [โ€“] 15 points 4 months ago (8 children)

    I was on arch as a vestige from my school days, having never quite found the time to switch to something more stable. When I saw the news over the weekend, I checked and found 1 would-be-infected package on my machine that was thankfully months out of date. I'm well past the point of wanting to examine PKGBUILDs every time (hence the out of date package). But, instead of just removing AUR packages and sticking to arch repos, I decided to sweep up the technical debt by wiping and installing Fedora. I'm liking it so far, minus the absolute pain in the ass that is Nvidia on Linux. Fuck academics and their insistence on writing everything targeting CUDA; otherwise, I'd have saved a good bit of money a few years ago with a much more compatible AMD card.

  • source
  • hideshow 8 child comments
  • [โ€“] 2 points 4 months ago

    Have you looked into drop-in (ZLUDA) or recompile (SCALE, chipStar) things? Though they may not have been helpful with the years gone by (and may each have their own pros/cons).

    I'm still using a 1050Ti (and legacy driver shifting to AUR did block me from updating), value doesn't seem great and not going to buy something used from eBay. So that still complicates things for me.

    Distro-wise I probably want something slower than Arch but not sure about point releases. And I am hoping for something that does updates in a way more friendly to slower internet (giving less update friction), but I suspect it doesn't exist. Some things (OpenSUSE, NixOS) seem like they might be closer to I want but I have hangups about them (Patterns on SUSE and lack of videos for Slowroll, NixOS having multiple solutions for dynamically linked executables especially if I decide to stop using Steam directly).

  • source
  • parent
  • [โ€“] 2 points 4 months ago (5 children)

    Isnt it just a single line command to get nvidia working?

  • source
  • parent
  • hideshow 5 child comments
  • [โ€“] 4 points 4 months ago* (1 child)

    You add the rpmfusion repo and install a few nvidia packages from there. Kernel modules are then built for the driver. If secure boot is used, they need to be signed too. Sometimes the grub entry isnt updated and doesnt load nvidia drivers. Sometimes you boot into a black screen, sometimes Wayland throws a hissy fit. Hardware accelerated video decoding needs more packages, in browsers it may need extra configuration..
    The components are all there and they work, but sometimes the stars don't align and you just curse a little and wonder why you didn't just buy AMD because that, just works.

  • source
  • parent
  • hideshow 1 child comment
  • [โ€“] 2 points 4 months ago

    In the simplest case, absolutely. I ran into black screens and wayland issues due to a combination of needing to enable simpledrm in the command line and working with secure boot. Not too much extra once you figure it out, though.

  • source
  • parent
  • [โ€“] 2 points 4 months ago (1 child)

    It's a couple commands and laid out cookbook style. Fedora has a very good document page on installing nVidia drivers. And the installation is generally very smooth.

    The biggest hang up for first time users is understanding that you need to wait for everything to build before doing sudo systemctl reboot. How long do you need to wait? No one really knows. There is no progress bar or any other notification that the building is done successfully. You just wait and then take a leap of faith into that dark abyss and hope for the best.

    Typically, it's recommended to wait โ€œat least 5 minutesโ€. Maybe more. I always waited around 10 minutes, (or one cup of tea) to be sure. But some users reported needing to wait was much as 20 minutes for everything to build. YMMV

  • source
  • parent
  • hideshow 1 child comment
  • [โ€“] 3 points 4 months ago* (last edited 4 months ago)

    Regarding the wait time, maybe I just got lucky, but just waited for my CPU usage to come back down and spammed modinfo -F version nvidia or some such until it stopped erroring. My actual hang-up was getting simpledrm working and then secure boot.

  • source
  • parent
  • [โ€“] 1 point 4 months ago

    The most frictionless distro to install nvidia drivers is Aurora. As you get ready to download the ISO, it will provide a couple of drop down menus to select your gpu. Intel/AMD is one and the other lists nvidia gpu's by card to add the correct driver to the ISO. You should be able to install the ISO and boot into your shiny new Plasma desktop with your nvidia gpu working just fine.

    And you get the atomic goodness of Fedora Kinonite.

  • source
  • parent
  • [โ€“] 12 points 4 months ago (12 children)

    So what are good antivirus options for Linux? is it still pretty much just ClamAV?

  • source
  • hideshow 12 child comments
  • [โ€“] 11 points 4 months ago (4 children)

    Our company uses eset https://www.eset.com/us/home/antivirus/

    But afaik it costs money to really work.

    But your brain should be the best antivirus you have.

  • source
  • parent
  • hideshow 4 child comments
  • [โ€“] 9 points 4 months ago (6 children)

    one thread I found from 2 years ago where someone asked for the same thing, a lot of the replies are just "you don't need antivirus on Linux" lmao

  • source
  • parent
  • hideshow 6 child comments
  • [โ€“] -1 points 4 months ago (4 children)

    a lot of the replies are just "you don't need antivirus on Linux"

    Which is completely true when using distros like Debian, Fedora, RHEL, OpenSuse, etc.

    Arch (and its derivatives) are designed to be on the bleeding edge with ALL the paper cuts that come with it. It is absolutely not focused on stability or security. If you want those things then stick to Debian or Fedora Silverblue.

    And the second you introduce npm to your system you can throw any semblance of security out the window, regardless of what your operating system is, and no antivirus is going to save you.

    That being said, the fundamental security models between Linux and Windows are very different. And on Linux the overall impact will likely be far less damaging (technologically, not financially) than on Windows. Windows "security" is just a corporate marketing campaign.

  • source
  • parent
  • hideshow 4 child comments
  • [โ€“] 2 points 4 months ago (3 children)

    If you use snap, or flatpaks, or npm, or anything like that you run the same risks.

  • source
  • parent
  • hideshow 3 child comments
  • [โ€“] 1 point 4 months ago (2 children)

    npm, yes. Snap and flatpak? No. I'm not saying it's impossible to get malware. The difference is that snapd and flatpak have various levels of process isolation that largely mitigates any potential issues.

    The argument isn't "Linux doesn't have malware", the argument is "you don't need to run antivirus on Linux". Those are two very different things.

    Not even the best antivirus will protect you completely, at that point you need good computer hygiene.

  • source
  • parent
  • hideshow 2 child comments
  • [โ€“] 1 point 4 months ago (1 child)

    Eh. Flatpak has the option for process isolation, but it kinda works similarly to how android apps have default permissions set and the packager can just go "nah, this gets FULL permissions" and unless you go look and change it yourself, the program isn't restricted at all. I don't use ubuntu/snapd so can't speak to that.

    There are more protections on flathub than the AUR for sure - the AUR is closer to just downloading random shit off the internet than a true repository. That said, it's crazy to assign the vulnerabilities of the AUR to Arch as a whole... The Arch repos proper (and even Chaotic AUR) didn't have problems during any of this.

  • source
  • parent
  • hideshow 1 child comment
  • [โ€“] 2 points 4 months ago

    Flatpak has the option for process isolation, but it kinda works similarly to how android apps have default permissions set and the packager can just go "nah, this gets FULL permissions" and unless you go look and change it yourself, the program isn't restricted at all.

    You're not wrong, but even with the AUR it's (last I checked/heard) a problem with orphaned packages being picked up by random users, and then a "new" PKGBUILD with the malicious bits getting uploaded.

    The reality is that even if everyone just blindly updated through yay this whole time, very few people would be affected because the number of orphaned packages installed is very low. The package managers tend to bug you about orphaned packages.

    The difference with Flatpaks and the Snap Store is that you can't just take ownership over an abandoned project. You'd have to create your own. And since Canonical is in charge of the Snap Store, they're quick to react to any sort of security issue.

    the AUR is closer to just downloading random shit off the internet than a true repository

    Ultimately that is what it is. Because some packages are grabbing files from just about anywhere.

    The Arch repos proper (and even Chaotic AUR) didn't have problems during any of this.

    And that's really the key. The AUR is bleeding edge with "here be dragons" philosophy. Like I said in my previous comment, if you can't accept those dangerous (work computer, sensitive data, etc) then simply don't use Arch.

  • source
  • parent
  • [โ€“] 51 points 4 months ago (5 children)

    Microslop is nervous now that Linux is popular enough to attack.

  • source
  • hideshow 5 child comments
  • [โ€“] 43 points 4 months ago (3 children)

    Linux has always been the bigger target. Even microslop uses linux for its severs.

  • source
  • parent
  • hideshow 3 child comments
  • [โ€“] 11 points 4 months ago

    Yeah I'm pretty glad that I've been behind in upgrading my aur packages recently.

  • source
  • [โ€“] 11 points 4 months ago

    With the old package managers safety was simple...trust the developers, user their packages. 10000 downloads? Easy! 1 download.... ๐Ÿค” Maybe skip for now.

    Now with executables like mac and Windows it's easier to sneak something in. You still rely on trust. But now you've got AI in the game mudding the waters.

  • source
  • It was certainly a weekend.

  • source
  • [โ€“] 10 points 4 months ago (2 children)

    I learnt a lesson yeah. It looks like I got away, there's no rootkit, I found nothing weird running, I don't have npm Installed, and up until now it doesn't seem like the packages I had installed were compromised. But I had way more AUR packages installed than I was aware of. And I was just updating them without really caring about the pkgbuild, I have better things to do. Multiple packages were outdated crap that shouldn't have been there anymore.

    I was careless and took too much risk. I reduced the Installed AUR packages to a minimum, and from now on I will verify the PKGBUILDs on every update. Maybe Arch isn't really what I need. I'm on the LTS kernel and I no longer really use the AUR. But switching will be a huge hassle and this setup will work well from here on out, so I'll stick to it for now

  • source
  • hideshow 2 child comments
  • [โ€“] 2 points 4 months ago* (1 child)

    I've been using Bazzite for a couple of years now and it's great. Almost boring how stable it is.

    And I access the AUR with an Arch distrobox if I need to

  • source
  • parent
  • hideshow 1 child comment
  • [โ€“] 4 points 4 months ago

    errr... just FYI, if you have AUR packages through distrobox, you are basically just as vulnerable as someone running vanilla arch. You checked if you have anything form the AUR on the nearly 2k (last I checked) package list?

  • source
  • parent
  • [โ€“] 9 points 4 months ago

    Everyone knows if you use Kali you're immune to malware

  • source
  • [โ€“] 25 points 4 months ago

    And you believe that makes you safe?

    Shit like this is a blemish on the Linux community.

  • source
  • [โ€“] 14 points 4 months ago (1 child)

    Arch users just randomly dropping "I use Arch btw" everywhere, it was only a matter of time.

  • source
  • hideshow 1 child comment
  • [โ€“] 5 points 4 months ago

    Hi there ๐Ÿ‘‹

    Don't have installed much from the AUR though.

  • source
  • Me!!!!

    But I'm actually safe: Last month I fried half of my BTRFS array, and decided that instead of recovering the system, I'd rather copy over the relevant data and reinstall Arch from scratch. In doing so, I've shed the majority of AUR packages that my old system had. Of the handful of AUR packages on my new system, none were attacked.

  • source
  • [โ€“] 7 points 4 months ago

    I am at "no fucking yays and the bunch, check the package create/update dates, read PKGBUILD, only update when necessary". Has served me well so far

  • source
  • [โ€“] 6 points 4 months ago* (2 children)

    Anyone catch that hilarious LLM exchange on aur-general mailing list over the weekend?

    E: found it

  • source
  • hideshow 2 child comments
  • Well that's fun. Odd someone named Campbell asking was for a tomato soup recipe, you'd think that would just be built into their bloodline or something.

    While I'm glad no JS package managers were hurt to make the soup, I do wish the recipe didn't waste so much water.

  • source
  • parent
  • [โ€“] 6 points 4 months ago

    Doesn't work like this.

  • source
  • [โ€“] 3 points 4 months ago*

    Use the AUR, have an antivirus, no infected packages. However I was thinking of switching to https://chimera-linux.org/ before the infected packages went out.

  • source
  • [โ€“] 4 points 4 months ago*

    The unsandboxed package model was only ever safe in its original conception - with organizationally trusted and cryptographically enforced maintainer model. Remove the maintainer/developer trust requirement and you need a sandbox in order to prevent malware having root access on your system. Tis why mobile apps were sandboxed on Android and iOS from the get go.

  • source
  • [โ€“] 4 points 4 months ago

    Custom OS that no one else has access to. It might be full of exploits and bugs, but only you would know that. ๐Ÿ˜‰

  • source
  • [โ€“] 2 points 4 months ago

    So... rkhunter?

  • source
  • [โ€“] 3 points 4 months ago* (1 child)

    Never use things like yay, just read the PKGBUILD and run makepkg. AUR wasn't meant to be automated. But it's better to use Flatpak, because it provides sandboxing (not for every app, but it can be reviewed before installation).

  • source
  • hideshow 1 child comment
  • [โ€“] 8 points 4 months ago

    Using aur helpers is fine if they make it easy to read the pkgbuild, which paru does. It's too annoying to check for PKGBUILD and upstream/vcs updates for each package individually.

    Ideally the aur helper would point out when 1) a package changed maintainers since your last install, 2) a package's PKGBUILD itself changed (not just the upstream/vcs source), 3) the PKGBUILD is less than 24h old or so. And for #2, it should also show you the changes similar to what you see on the AUR site's "view changes" page. I'm not aware of any aur helper that does these things, but hopefully recent events prompt a change.

  • source
  • parent
  • [โ€“] 1 point 4 months ago
    [โ€“] 1 point 4 months ago (3 children)

    ive been looking for an antivirus since i want to be able to download random stuff from the internet without having to review it

  • source
  • hideshow 3 child comments
  • [โ€“] 3 points 4 months ago (1 child)

    Clamav is pretty good if all you're wanting to do is scan the files you've downloaded so that you're not potentially re-transmitting viruses.

    Outside of that, maybe consider using SELinux for security, or possibly if you're going to be doing risky downloads, do it on a virtual machine, on a virtual network.

  • source
  • parent
  • hideshow 1 child comment