448
400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers (cybersecuritynews.com)
submitted 3 months ago by to c/technology@lemmy.world
144 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 21 points 3 months ago (4 children)

I have always been nervous about this type of thing happening with the AUR. Thankfully many packages I used to need the AUR for have since added native versions or made flatpaks. I hope AUR users don't have too many issues from this!

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 9 points 3 months ago (3 children)

    flatpaks arn't any safer and with how poor the sandbox is handled by 99% of devs. Hell flatpaks have a new issue every other month. Its almost more often to see a new flatpak problem then aur problem.

    Its literally no safer in reality sure on paper its safer but reality has proven that flatpaks just are not some magical fix to this problem.

    Hell half the time when flatpaks do have issues they go unaddressed or fixed for months after they are found. While AUR problems get smacked real fucking fast after they are found.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 3 months ago

    I agree that Flatpak’s utilization of sandboxing is weaker in practice than is marketed. I get that many apps ship with home/host filesystem access instead of granular permissions, but it does provide meaningful isolation when used correctly.

  • permalink
  • fedilink
  • source
  • parent