Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

lists.archlinux.org

Post reply on HN
Print view View original

91–100 of 142 posts

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#91

Post by Shellban »

urda wrote: post #42
ASalazarMX wrote: post #20

Earlier quoted context omitted.

The only thing I've seen Arch exploding in popularity has been memes. It's a fun distro for hobbyists, but too inconvenient as a daily driver.

If Arch is too "inconvenient" as a daily driver, you might find yourself more at "home" on a Windows install instead.

Well, Arch has (historically) been rather difficult to install from scratch, and requires a lot of Linux knowledge to get up-and-running as a daily driver. If one is installing it for the first time and misses something (which audio backend?), it can be rather frustrating down the line.

There is a reason Ubuntu is usually the first distro new Linux users go to. For almost a decade now, installing a feature-complete Ubuntu setup is not much more difficult than reimaging Windows.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#92

Post by LeoPanthera »

diggan wrote: post #75
LeoPanthera wrote: post #38

Earlier quoted context omitted.

This is a slight aside, but CachyOS is a great example of the failure of Wikipedia politics. The "CachyOS" page was deleted[1], and replaced with a redirect to the Arch Linux page. But CachyOS is not mentioned anywhere on that page, nor on the "List of Linux distributions § Arch Linux-based" page. [1]: https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletio...

It links to https://en.wikipedia.org/wiki/Arch_Linux#Derivatives which indeed lacks any mention of CachyOS. Luckily, Wikipedia is free to register, and you can just edit pages you feel like could be better. Seems like you found the perfect first edit to make for yourself :)

I have a long Wikipedia history, but that is not the point. There already was a CachyOS page, and it was removed. Why bother contributing stuff that will just be deleted again?

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#93

Post by WD-42 »

ASalazarMX wrote: post #20
WD-42 wrote: post #12

As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.

The only thing I've seen Arch exploding in popularity has been memes. It's a fun distro for hobbyists, but too inconvenient as a daily driver.

This is just ignorant. I've been daily driving Linux since 2005. The majority of that time has been with Arch. Despite the memes, I've found it to be MORE stable than your typical Debian derivatives. It's funny to me that it took over a decade for people to come to the same realization.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#94

Post by f33d5173 »

diggan wrote: post #75
LeoPanthera wrote: post #38

Earlier quoted context omitted.

This is a slight aside, but CachyOS is a great example of the failure of Wikipedia politics. The "CachyOS" page was deleted[1], and replaced with a redirect to the Arch Linux page. But CachyOS is not mentioned anywhere on that page, nor on the "List of Linux distributions § Arch Linux-based" page. [1]: https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletio...

It links to https://en.wikipedia.org/wiki/Arch_Linux#Derivatives which indeed lacks any mention of CachyOS. Luckily, Wikipedia is free to register, and you can just edit pages you feel like could be better. Seems like you found the perfect first edit to make for yourself :)

It's an endemic issue on wikipedia, and even editing wouldn't fix this one instance, since someone can (and demonstrably already has) remove whatever you add later on. The issue is wikipedias preference for "deletionism", removing perfectly correct information for no particularly good reason. It's especially pernicious when it comes to short articles, which tend to get deleted with impunity, and redirected to sections of articles, which later get renamed, destroying the link, or removed altogether. Nothing can be done by any individual to fix this issue, since it comes from a wikipedia wide policy, which unfortunately is not one of the things that "anyone can edit".

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#95

Post by WD-42 »

Barrin92 wrote: post #53

There's always been this security theater of people recommending arch because they "don't trust the companies" or Canonical or what have you but frankly I'm surprised this hasn't happened sooner. Well or maybe it has and we don't know. Running random binaries on your computer uploaded by some anonymous dude has to be the equivalent of buying heart medicine on craigslist. And because Arch is so barebones to begin with…

How exactly is Arch barebones? It basically ships with everything I need, more than most distros (Zed and Discord are good examples). I don't even need to use the AUR.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#96

Post by VTimofeenko »

LeoPanthera wrote: post #92
diggan wrote: post #75

Earlier quoted context omitted.

It links to https://en.wikipedia.org/wiki/Arch_Linux#Derivatives which indeed lacks any mention of CachyOS. Luckily, Wikipedia is free to register, and you can just edit pages you feel like could be better. Seems like you found the perfect first edit to make for yourself :)

I have a long Wikipedia history, but that is not the point. There already was a CachyOS page, and it was removed. Why bother contributing stuff that will just be deleted again?

It might have been removed due to the editor's impression that CachyOS is not significantly different from Arch. With proof to the contrary the page may be restored.

There are a lot of derivative(I don't mean it in a negative way) distors out there, not sure if they all need pages.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#97

Post by diggan »

f33d5173 wrote: post #94
diggan wrote: post #75

Earlier quoted context omitted.

It links to https://en.wikipedia.org/wiki/Arch_Linux#Derivatives which indeed lacks any mention of CachyOS. Luckily, Wikipedia is free to register, and you can just edit pages you feel like could be better. Seems like you found the perfect first edit to make for yourself :)

It's an endemic issue on wikipedia, and even editing wouldn't fix this one instance, since someone can (and demonstrably already has) remove whatever you add later on. The issue is wikipedias preference for "deletionism", removing perfectly correct information for no particularly good reason. It's especially pernicious when it comes to short articles, which tend to get deleted with impunity, and redirected to section…

I agree with most of what you wrote, but unless you can demonstrate that someone actually added CachyOS to the "Arch Linux-based" on the "List of Linux distributions" page and it was later removed, I'm not sure how much it matters how Wikipedia generally works.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#98

Post by Barrin92 »

WD-42 wrote: post #95
Barrin92 wrote: post #53

There's always been this security theater of people recommending arch because they "don't trust the companies" or Canonical or what have you but frankly I'm surprised this hasn't happened sooner. Well or maybe it has and we don't know. Running random binaries on your computer uploaded by some anonymous dude has to be the equivalent of buying heart medicine on craigslist. And because Arch is so barebones to begin with…

How exactly is Arch barebones? It basically ships with everything I need, more than most distros (Zed and Discord are good examples). I don't even need to use the AUR.

Just by taking a glance at the most popular packages (https://aur.archlinux.org/packages)

Pretty much every browser that isn't Firefox including Chrome, VS Code, most proprietary software like Slack, Zoom, Spotify, many vpn clients and password managers, a lot of them seemingly not published by the companies in question.

All of those ancillary password, vpn or security related products who aren't going to be in the main repo because they have proprietary elements and also rely on random people seems particularly bad. And there's a lot of software in that category.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#99

Post by WD-42 »

Barrin92 wrote: post #98
WD-42 wrote: post #95

Earlier quoted context omitted.

How exactly is Arch barebones? It basically ships with everything I need, more than most distros (Zed and Discord are good examples). I don't even need to use the AUR.

Just by taking a glance at the most popular packages ( https://aur.archlinux.org/packages ) Pretty much every browser that isn't Firefox including Chrome, VS Code, most proprietary software like Slack, Zoom, Spotify, many vpn clients and password managers, a lot of them seemingly not published by the companies in question. All of those ancillary password, vpn or security related products who aren't going to be in the…

And what distro does package those?

That's what Flatpak is for. If you must install crappy proprietary software, at least get an official package from the developer.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#100

Post by gus_ »

defraudbah wrote: post #50

i installed a lot of cra* from aur in the past, wouldn't be surprised if i got a malware somewhere. Strange thing, I don't think open snitch would even help in such situation.. and official repo does not have enough packages to run arch :\ I don't want to go back to ubuntu

I haven't taken a look at the malware, but it seems to download files from the Internet so it should have warned you to allow/deny the outbound connections.

It'd be nice to test it with a sample of aur package/malware.

Post reply on HN