Holytimes comments on 400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers

Technology

88,253 readers

15,014 active

3,005 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago

moderators

[–] Holytimes@sh.itjust.works 9 points 3 months ago (3 children)

flatpaks arn't any safer and with how poor the sandbox is handled by 99% of devs. Hell flatpaks have a new issue every other month. Its almost more often to see a new flatpak problem then aur problem.

Its literally no safer in reality sure on paper its safer but reality has proven that flatpaks just are not some magical fix to this problem.

Hell half the time when flatpaks do have issues they go unaddressed or fixed for months after they are found. While AUR problems get smacked real fucking fast after they are found.

permalink

fedilink

source

parent

hideshow 3 child comments

[–] Eldritch@piefed.world 5 points 3 months ago

The one positive with flatpak is that it allows for universal deployment. A lot of projects are providing official builds. But you are still relying on them to vet what they put in.

permalink

fedilink

source

parent

[–] anyhow2503@lemmy.world 2 points 3 months ago

I haven't heard about all of these flatpak malware incidents.

permalink

fedilink

source

parent

[–] coolguy98@lemmy.dbzer0.com 0 points 3 months ago

I agree that Flatpak’s utilization of sandboxing is weaker in practice than is marketed. I get that many apps ship with home/host filesystem access instead of granular permissions, but it does provide meaningful isolation when used correctly.

permalink

fedilink

source

parent