81–90 of 137 posts
Earlier quoted context omitted.
Ah, in that case, most I've come across do not default to 'edit', but rather to accept. Notice that many default to automatic building: https://wiki.archlinux.org/index.php/AUR_helpers#Active
Huh. Thanks for the link; I hadn't realized that pacaur was announced unmaintained last December. I'll have to look for a replacement.
Earlier quoted context omitted.
Imho, especially things that are important solutions to common things on the Archwiki but are AUR, indicated with the AUR superscript there. For example for MTP: https://wiki.archlinux.org/index.php/Media_Transfer_Protocol The one that worked most stable for me was simple-mtpfs, but it's AUR. It happens with other archwiki topics too, I encounter it regularly though can't think of good examples from the top of my hea…
>simple-mtpfs Not maintained (last commit in 2016). So that will be something low on the priority list. >btrfs The dedupe tool looks interesting. Noted on my todo. >closure-compiler Was dropped from the repository. Probably because of the lack of an maintainer.
I see! Time for me to start looking for a new method of transfering files from android then, thanks for the heads up
I mean, is this new information? I always look at the upvotes on the package to see if it has been tested.
Yeah it would be better if the packages had all-time upvotes as well as “upvotes for this version”.
Many packages use rolling versions from git commits, so while the PKGBUILDs don't get updated, any time a user re-runs makepkg on that PKGBUILD the latest commit is pulled and built.
In those cases, a PKGBUILD might be months or years old, but still consistently up to date and valid.
Earlier quoted context omitted.
Nothing that I know off. Are you thinking specific to Arch Linux or in general?
In general, but also containing malware found in code belonging to the different distributions, like PKGBUILDs. I'm just thinking that part of the problem with the lack of review of AUR packages by the users is that it's not really obvious what one should be on the lookout for. What does linux malware found in the wild generally look like?, is what I'm wondering. I would think that it would benefit us all to make the…
if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
retval = -EINVAL;
More info of this particular one at e.g. https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-... or just search for 'linux backdoor attempt'
This is exactly what we've been preparing for. Don't use yaourt, and read those diffs. I know a lot of people don't do this, but it's important.
What would you recommend over yaourt?
Earlier quoted context omitted.
>simple-mtpfs Not maintained (last commit in 2016). So that will be something low on the priority list. >btrfs The dedupe tool looks interesting. Noted on my todo. >closure-compiler Was dropped from the repository. Probably because of the lack of an maintainer.
> Not maintained (last commit in 2016). So that will be something low on the priority list. I see! Time for me to start looking for a new method of transfering files from android then, thanks for the heads up
I personally just install termux, which allows you to install openssh. Run sshd and then you can use rsync or scp or sshfs or other from the host PC.
Earlier quoted context omitted.
Yaourt shows a big fat red warning every time you install a package. It also offers to open PKGBUILD and .install files for inspection.
It should just show the PKGBUILD every time. If it's not doing anything sketchy it's often only a dozen lines.
For the people interested, here's the actual commit from the acroread package: https://aur.archlinux.org/cgit/aur.git/commit/?h=acroread&id...
So much for being sneaky malware, he wasn't even trying to hide it... Any insertion of a `curl` command to some shady looking TLD piping to bash is going to be a massive red flag to even unsophisticated linux users.
Not much to see here, fortunately.
Package managers are an inherently flawed way to distribute software, instead of obtaining your programs from whoever developed that program you get it from your OS developer!.
Earlier quoted context omitted.
Because there is this myth that only Windows users get infected because Windows is insecure, that packages are vetted, that code being open source means that a backdoor insertion would quickly be discovered, and so on.
Packages are vetted, in the repos, just not in AUR. They also keep tools that would easily/automatically build and install packages from AUR out of the main repos, to encourage manual handling and individual consideration of AUR package build scripts. Also this malware was found in AUR within a few hours of it going up.