• magnolia_mayhem@lemmy.world
      1·
      27 seconds ago

      Just keep sending requests and use as many tokens as possible. My wife spent 30 minutes on the phone with a bit the other day, just getting it to dump huge sets of instructions to waste tokens.

    • helpImTrappedOnline@lemmy.world
      1·
      28 seconds ago

      Well that’s fun. Odd someone named Campbell asking for a tomato soup recipe, you’d think that would just be built into their bloodline or something.

      While I’m glad no JS managers were hurt to make the soup, I do wish the recipe didn’t waste so much water.

    • addie@feddit.uk
      241·
      16 hours ago

      Zero remote exploits since it was released. That’s what divinely-inspired coding looks like, everyone.

      • Hypocrite9554@lemmy.world
        8·
        13 hours ago

        Out of curiosity, is that actually true? Surely our lord and saviour must have made a tiny slip-up

        Edit: Apparently TempleOS doesn’t have networking

        • Rooster326@programming.dev
          7·
          11 hours ago

          It is networked >!to G̷̗̙͚̥͓̼̠̩͙̀̃̎̌ǫ̷̢͈̭̪̮̝͚̟̹̭̤͇͕̪̍̅̈́͊̌̀̐͌̽d̷̡̮͕͉̥̂̽̔̾̓̋̚͘͠!<

    • Crozekiel@lemmy.zipEnglish
      2·
      5 hours ago

      I am really curious about this. If someone had ClamAV and updated any of these packages from the AUR during the attack, would ClamAV have “solved” that problem? I would love to know the effectiveness of that.

    • Siegfried@lemmy.world
      4·
      14 hours ago

      Did clamav work with AUR affected packages? Sorry if the question is idiotic, cause im ignorant when it comes to security

      • UnderpantsWeevil@lemmy.worldEnglish
        5·
        12 hours ago

        But your brain should be the best antivirus you have.

        True of virtually every OS.

        But “only stupid people get viruses” is exactly the kind of trap that catches folks.

      • pressanykeynow@lemmy.world
        20·
        18 hours ago

        But your brain should be the best antivirus you have.

        Is there an AUR package for it? seems not in the official repo

      • placebo@lemmy.zipEnglish
        8·
        15 hours ago

        But your brain should be the best antivirus you have.

        It’s useful to use brain, but any security layer has holes which is why it’s good to have several layers. Some attacks might be way beyond user’s understanding or come from trusted sources.

      • AceSLive@lemmy.world
        2·
        14 hours ago

        I have eset home but now I’ve gone completely linux, and they don’t do it for home - only business

        Which sucks, as I have a year left on my subscription I can no longer use :/

    • Ghoelian@piefed.socialEnglish
      101·
      19 hours ago

      one thread I found from 2 years ago where someone asked for the same thing, a lot of the replies are just “you don’t need antivirus on Linux” lmao

      • CeeBee_Eh@lemmy.world
        23·
        11 hours ago

        a lot of the replies are just “you don’t need antivirus on Linux”

        Which is completely true when using distros like Debian, Fedora, RHEL, OpenSuse, etc.

        Arch (and its derivatives) are designed to be on the bleeding edge with ALL the paper cuts that come with it. It is absolutely not focused on stability or security. If you want those things then stick to Debian or Fedora Silverblue.

        And the second you introduce npm to your system you can throw any semblance of security out the window, regardless of what your operating system is, and no antivirus is going to save you.

        That being said, the fundamental security models between Linux and Windows are very different. And on Linux the overall impact will likely be far less damaging (technologically, not financially) than on Windows. Windows “security” is just a corporate marketing campaign.

          • CeeBee_Eh@lemmy.world
            2·
            3 hours ago

            npm, yes. Snap and flatpak? No. I’m not saying it’s impossible to get malware. The difference is that snapd and flatpak have various levels of process isolation that largely mitigates any potential issues.

            The argument isn’t “Linux doesn’t have malware”, the argument is “you don’t need to run antivirus on Linux”. Those are two very different things.

            Not even the best antivirus will protect you completely, at that point you need good computer hygiene.

  • gerryflap@feddit.nl
    9·
    18 hours ago

    I learnt a lesson yeah. It looks like I got away, there’s no rootkit, I found nothing weird running, I don’t have npm Installed, and up until now it doesn’t seem like the packages I had installed were compromised. But I had way more AUR packages installed than I was aware of. And I was just updating them without really caring about the pkgbuild, I have better things to do. Multiple packages were outdated crap that shouldn’t have been there anymore.

    I was careless and took too much risk. I reduced the Installed AUR packages to a minimum, and from now on I will verify the PKGBUILDs on every update. Maybe Arch isn’t really what I need. I’m on the LTS kernel and I no longer really use the AUR. But switching will be a huge hassle and this setup will work well from here on out, so I’ll stick to it for now

    • prole@sh.itjust.worksEnglish
      3·
      14 hours ago

      I’ve been using Bazzite for a couple of years now and it’s great. Almost boring how stable it is.

      And I access the AUR with an Arch distrobox if I need to

      • Crozekiel@lemmy.zipEnglish
        3·
        5 hours ago

        errr… just FYI, if you have AUR packages through distrobox, you are basically just as vulnerable as someone running vanilla arch. You checked if you have anything form the AUR on the nearly 2k (last I checked) package list?

    • placebo@lemmy.zipEnglish
      9·
      15 hours ago

      Tbf most major attacks we saw recently are cross-platform thanks to npm. AUR has always been a security risk.

    • Alaknár@sopuli.xyz
      3·
      14 hours ago

      Wasn’t that long ago when I was downvoted to oblivion for saying that. Glad to see the community is maturing.

  • Shanmugha@lemmy.world
    91·
    20 hours ago

    I am at “no fucking yays and the bunch, check the package create/update dates, read PKGBUILD, only update when necessary”. Has served me well so far

  • wylinka@szmer.info
    63·
    16 hours ago

    Never use things like yay, just read the PKGBUILD and run makepkg. AUR wasn’t meant to be automated. But it’s better to use Flatpak, because it provides sandboxing (not for every app, but it can be reviewed before installation).

    • Kogasa@programming.dev
      7·
      15 hours ago

      Using aur helpers is fine if they make it easy to read the pkgbuild, which paru does. It’s too annoying to check for PKGBUILD and upstream/vcs updates for each package individually.

      Ideally the aur helper would point out when 1) a package changed maintainers since your last install, 2) a package’s PKGBUILD itself changed (not just the upstream/vcs source), 3) the PKGBUILD is less than 24h old or so. And for #2, it should also show you the changes similar to what you see on the AUR site’s “view changes” page. I’m not aware of any aur helper that does these things, but hopefully recent events prompt a change.

  • HisAssholiness@lemmy.ml
    151·
    22 hours ago

    Arch users just randomly dropping “I use Arch btw” everywhere, it was only a matter of time.

  • ornery_chemist@mander.xyz
    14·
    1 day ago

    I was on arch as a vestige from my school days, having never quite found the time to switch to something more stable. When I saw the news over the weekend, I checked and found 1 would-be-infected package on my machine that was thankfully months out of date. I’m well past the point of wanting to examine PKGBUILDs every time (hence the out of date package). But, instead of just removing AUR packages and sticking to arch repos, I decided to sweep up the technical debt by wiping and installing Fedora. I’m liking it so far, minus the absolute pain in the ass that is Nvidia on Linux. Fuck academics and their insistence on writing everything targeting CUDA; otherwise, I’d have saved a good bit of money a few years ago with a much more compatible AMD card.

    • Bluewing@lemmy.world
      1·
      13 hours ago

      The most frictionless distro to install nvidia drivers is Aurora. As you get ready to download the ISO, it will provide a couple of drop down menus to select your gpu. Intel/AMD is one and the other lists nvidia gpu’s by card to add the correct driver to the ISO. You should be able to install the ISO and boot into your shiny new Plasma desktop with your nvidia gpu working just fine.

      And you get the atomic goodness of Fedora Kinonite.

    • insomniac_lemon@lemmy.cafeEnglish
      2·
      20 hours ago

      Have you looked into drop-in (ZLUDA) or recompile (SCALE, chipStar) things? Though they may not have been helpful with the years gone by (and may each have their own pros/cons).

      I’m still using a 1050Ti (and legacy driver shifting to AUR did block me from updating), value doesn’t seem great and not going to buy something used from eBay. So that still complicates things for me.

      Distro-wise I probably want something slower than Arch but not sure about point releases. And I am hoping for something that does updates in a way more friendly to slower internet (giving less update friction), but I suspect it doesn’t exist. Some things (OpenSUSE, NixOS) seem like they might be closer to I want but I have hangups about them (Patterns on SUSE and lack of videos for Slowroll, NixOS having multiple solutions for dynamically linked executables especially if I decide to stop using Steam directly).

      • ornery_chemist@mander.xyz
        2·
        5 hours ago

        In the simplest case, absolutely. I ran into black screens and wayland issues due to a combination of needing to enable simpledrm in the command line and working with secure boot. Not too much extra once you figure it out, though.

      • Bluewing@lemmy.world
        2·
        13 hours ago

        It’s a couple commands and laid out cookbook style. Fedora has a very good document page on installing nVidia drivers. And the installation is generally very smooth.

        The biggest hang up for first time users is understanding that you need to wait for everything to build before doing sudo systemctl reboot. How long do you need to wait? No one really knows. There is no progress bar or any other notification that the building is done successfully. You just wait and then take a leap of faith into that dark abyss and hope for the best.

        Typically, it’s recommended to wait “at least 5 minutes”. Maybe more. I always waited around 10 minutes, (or one cup of tea) to be sure. But some users reported needing to wait was much as 20 minutes for everything to build. YMMV

        • ornery_chemist@mander.xyz
          2·
          5 hours ago

          Regarding the wait time, maybe I just got lucky, but just waited for me CPU usage to come back down and spammed modinfo -F version nvidia or some such until it stopped erroring. My actual hang-up was getting simpledrm working and then secure boot.

      • PieMePlenty@lemmy.world
        4·
        15 hours ago

        You add the rpmfusion repo and install a few nvidia packages from there. Kernel modules are then built for the driver. If secure boot is used, they need to be signed too. Sometimes the grub entry isnt updated and doesnt load nvidia drivers. Sometimes you boot into a black screen, sometimes Wayland throws a hissy fit. Hardware accelerated video decoding needs more packages, in browsers it may need extra configuration…
        The components are all there and they work, but sometimes the stars don’t align and you just curse a little and wonder why you didn’t just buy AMD because that, just works.

  • macniel@feddit.org
    963·
    1 day ago

    Linux Users: haha those silly windows users, always searching the web for their software and getting viruses.
    Linux Users: oh no I got malware by searching the AUR!

    • rtxn@lemmy.worldM
      391·
      1 day ago

      The AUR is still safer. One, it is at least minimally moderated. If a malicious package is detected, it can be reported and removed. Two, the installer is usually not just a black box executable. Three, most of the build and runtime dependencies are from the official Arch repos, which provides some protection against supply chain attacks. For Windows installers, you have to trust the distributor to bundle clean DLLs (for that matter, the same applies to AppImages).

      But if it starts downloading anything from NPM… ^C and run.

      • Lucy :3@feddit.org
        20·
        1 day ago

        The most unsafe factor of the AUR is aur helpers and their goal to dumb everything down and streamline the process as if the AUR where an official repo

        • CubitOom@infosec.pubEnglish
          8·
          1 day ago

          I’m not entirely sure I agree, I think the issue is with default settings.

          Like you could use both yay and paru to diff the PKGBUILD of the most recent updat and then read it, and then approve each. And I think that’s pretty helpful. But you could also just blindly accept the update with the right config or flag and that is not a good practice.

          • bitfucker@programming.dev
            3·
            19 hours ago

            Yeah, use and promote aurto instead. They require you to trust the maintainer and would remove the package from the local repo if the maintainer is changed

            • CubitOom@infosec.pubEnglish
              2·
              13 hours ago

              I’m not sure if loosing the maintainer is to only thing we should be going off of here, but I like the name.

              • bitfucker@programming.dev
                1·
                12 hours ago

                Well, it is just like a distro maintainer account anyway. If the maintainer account is compromised then gg for the whole distro. That’s what happens with other supply chain attacks as well and yes, I do think we need a way to fix that without compromising on ease of usability

                • CubitOom@infosec.pubEnglish
                  1·
                  12 hours ago

                  We arnt talking about a distro maintainer, but an aur package maintainer, which can be anyone.

    • Lucy :3@feddit.org
      7·
      1 day ago

      By misusing the AUR and ignoring every warning telling you to read and understand the pkgbuild or don’t do it.