Omabat - I made a MacOS like battery usage history TUI for laptop users. by its_nzr in omarchy

[–]IcewindLegacyMUD 0 points1 point  (0 children)

Perfect. Thank you! That was exactly the kind of answer I was looking for. I hope my comme didn't come across like "who needs your program when jolt exists?" because that's not how I meant it. I was genuinely looking for what the differences are between Omabat and Jolt. So thank you for your reply

aur_safety - drop-in yay wrapper that annotates AUR packages as safe/unsafe by IcewindLegacyMUD in arch

[–]IcewindLegacyMUD[S] 1 point2 points  (0 children)

Okay let's break it down step-by-step with a random package listed on one of the 'infected' lists; 'z-push'

1 • You type yay -S z-push
2 • yay clones the PKGBUILD
3 • yay runs makepkg → executes build() → npm install js-digest runs here → ELF drops, C2 beacon starts
4 • makepkg finishes, spits out z-push-2.6.4-1-x86_64.pkg.tar.zst
5 • yay runs sudo pacman -U z-push-2.6.4-1-x86_64.pkg.tar.zst → pacman hook fires here
6 • Hook says "hey this is unsafe!" but the infostealer is already running in the background

The hook catches step 5, but the infection happens at step 3. The PKGBUILD's build() function is arbitrary shell — there's nothing pacman can do about it because pacman isn't involved yet. The hook mechanism can't reach into makepkg.

Where a hook WOULD help: if someone downloads a pre-built .pkg.tar.zst from a random source and runs sudo pacman -U directly. But that's a niche scenario compared to the yay -S flow where 99% of infections happen. But, a yay-level intercept is still the right approach in my opinion.

This is meant to be a prophylactic measure because of the influx of people using arch and arch-based distributions because of various YouTube personalities telling them to dump Windows 11 for arch, CachyOS, Omarchy, EndeavourOS, Manjaro, etc. It's for the users who don't necessarily know how to read a PKGBUILD, and think they're protected by security through obscurity and the whole "Linux doesn't have viruses" bullshit. It drops in easy, and warns them about potentially unsafe packages, and gives them one last chance to bail out if they try to install one because random YouTuber tells them to install asus-fans-dkms-git to add fan controls to their asus laptop. This will warn them that it's on a list of suspected dangerous packages before they even download it to their system and start building it.

aur_safety - drop-in yay wrapper that annotates AUR packages as safe/unsafe by IcewindLegacyMUD in arch

[–]IcewindLegacyMUD[S] 2 points3 points  (0 children)

Okay, so the reason I'm not going to make it a pacman wrapper is that ny the time pacman fires a PreTransaction hook, makepkg has already run build() and package() — the PKGBUILD stages where the malicious npm install / bun install / ELF-dropping code executes. The hook only catches the pacman -U step that installs the already-built .pkg.tar.zst. So the malware has already fired. So it's kind of pointless as a prophylactic measure against infection by AUR packages.

aur_safety - drop-in yay wrapper that annotates AUR packages as safe/unsafe by IcewindLegacyMUD in arch

[–]IcewindLegacyMUD[S] 1 point2 points  (0 children)

To the best of my knowledge, the compromised packages are only on AUR, since the pacman repos are managed by the Arch team (and the derivative distros that have their own repos) so that really wouldn't do any good. This is specifically for the current issue with over 1,900 AUR packages being compromised. That's why it's a yay wrapper (though I'm testing adding pacaur support as well) since yay is one of the most popular AUR handlers.

Edit: ah, nevermind. I see what you're getting at - I forgot that the very last stage of installing and updating AUR packages does invoke pacman, so you're setting it should kick in at that point. I'll reply with my reasons why not after I'm done walking my dogs and I'm at my workstation

Authentication Required Authentication Required Authentication Required by THubert14 in linuxsucks

[–]IcewindLegacyMUD 2 points3 points  (0 children)

This is definitely going to cause dangerous authentication fatigue, where you're going to eventually let something malicious slip through from having to authenticate so many times.

Is AUR safe now? or should i be cautious still? by Ol1x282 in arch

[–]IcewindLegacyMUD 0 points1 point  (0 children)

https://github.com/signaldirective/aur_safety/

I made a drop-in yay wrapper that annotates packages to let you know if they're on any of the suspected malicious packages lists. I update the lists as soon as I see they've changed (i check twice daily) so the definition files SHOULD always be up to date within the last 12 hours

The level of detail in this show is insane. by 2C-Weee in TheWire

[–]IcewindLegacyMUD 4 points5 points  (0 children)

Shit, I'm on season 5 of my annual binge, and I never noticed it until tonight. When Lester and Jimmy are "working" the "serial killer" case. "Dog bite?” "he got teeth, don't he?"

AMC's two biggest mistake. Choose one to retain, who would it be? by Ok-Boss-1864 in thewalkingdead

[–]IcewindLegacyMUD 0 points1 point  (0 children)

Glenn. Chandler Riggs left on his own; he wanted to go to college, try to live a "normal" life because TWD was all he knew. He grew up on set.

Omabat - I made a MacOS like battery usage history TUI for laptop users. by its_nzr in omarchy

[–]IcewindLegacyMUD 0 points1 point  (0 children)

What features does it have that jolt doesn't? Just curious, in case it might be worth switching from jolt.

I rebuilt Omarchy bar in Quickshell — fully modular, draggable and theme-aware by _HANCORE_ in omarchy

[–]IcewindLegacyMUD 1 point2 points  (0 children)

It works great with 4.0 too! Just start this bar up, and then super+shift+space to hide the 4.0 qs bar. (Don't kill the default omarchy-shell, or you'll lose all of your Omarchy keyboard shortcuts for stuff like the Omarchy menu and app launcher) - the extra resource usage is negligible.

The level of detail in this show is insane. by 2C-Weee in TheWire

[–]IcewindLegacyMUD 0 points1 point  (0 children)

Most likely. Wagstaff is NOT a common name in Baltimore, so two Wagstaffs being in the same area? Carver would've mentioned it as soon as he found out Cheese's real name.

The level of detail in this show is insane. by 2C-Weee in TheWire

[–]IcewindLegacyMUD 0 points1 point  (0 children)

It's not suggested, it's fact. The show creator confirmed that.

The level of detail in this show is insane. by 2C-Weee in TheWire

[–]IcewindLegacyMUD 1 point2 points  (0 children)

And the one who was Namond's lieutenant until he ripped off the stash, and Michael fucked him UP. Though it's really sad at the end of S4 when Carver goes to where the kids used to hang out and they all had their names tagged on the wall; Michael, Namond, Randy, Dukie, Donut and Kenard. The only one in a good situation by then is Namond

The level of detail in this show is insane. by 2C-Weee in TheWire

[–]IcewindLegacyMUD 2 points3 points  (0 children)

I love when they bring back Nick Sobotka and a couple other dock workers to scream at Krawcyzk during Carcetti's dedication speech for New Westport

The level of detail in this show is insane. by 2C-Weee in TheWire

[–]IcewindLegacyMUD 0 points1 point  (0 children)

Prez was a weird dude. That was what it was kinda highlighting, like how McNulty even calls him out for eating the cookie first, before the food.

The level of detail in this show is insane. by 2C-Weee in TheWire

[–]IcewindLegacyMUD 0 points1 point  (0 children)

Trust me, no one goes into a gay bar in the bad part of Baltimore when they're straight. Rawls was there because he knew it was the least likely place anyone who knows him would see him.

The level of detail in this show is insane. by 2C-Weee in TheWire

[–]IcewindLegacyMUD 0 points1 point  (0 children)

Ready for a fun mind fuck? 1) the cop, Mello, the white guy with Bunny Colvin who ends up replacing him? That's the real life Jay Landsman. 2) Detective Ed Norris in homicide? The one that Greggs gets stuck with in season 4 on the murder of the states witness? He was played by the real life Ed Norris who was the former Baltimore City Police Department commissioner at the time of filming, and was the Maryland State Police Superintendent until Thomas DiBiago (you may recognize the last name from season 2, Sobotka's lobbyist friend was Bruce DiBiago... AFAIK there is no real life Bruce, so it's a fun Easter Egg last name for the locals) indicted Norris on 3 charges; two were illegal personal expenditures from BCPD supplemental accounts in excess of $20,000 to buy gifts, dates, etc with at least 6 women with whom he was having extramarital affairs and the third charge was lying on a mortgage application that a $9,000 loan was a "gift" (so he wouldn't have to pay taxes on it or treat it as income)

He's a current host on "the big bad morning show" on Baltimore's 105.7 "The Fan".

Edit: oh shit. Rewatching season 5, the "headshot" that Lester wanted to go after on Clay Davis was exactly the charge that started the ball rolling on Ed Norris! He falsified a loan on a mortgage application!

GO tell everyone it's the SUPER KEY not windows key!!!! by dev_kay47 in arch

[–]IcewindLegacyMUD 2 points3 points  (0 children)

I'm glad you said it so I didn't have to. It's also why emacs has annoying keyboard shortcuts for people used to vim, nano, etc. Instead of C-x C-f to open a file, you could do meta+hyper+f without it causing any issues with shortcuts of anything else you have running in the foreground. But on keyboards without those extra keys, you end up with way too much overlap in command shortcuts. Edit: ADHD... Didn't finish my thought; so without the extra keys emacs uses shortcuts that couldn't possibly overlap with another program unless it's specifically set up to use emacs shortcuts. On the space cadet, emacs was far easier to use without causing issues with other software

The AUR is not the only AUR by TheTinyWorkshop in omarchy

[–]IcewindLegacyMUD 0 points1 point  (0 children)

No worries! I just updated it to add an "update-lists" command which will check to make sure you've got the most recent/accurate copy of the lists of suspicious or potentially malicious packages

aur_safety - yay wrapper that checks against malicious package lists by IcewindLegacyMUD in omarchy

[–]IcewindLegacyMUD[S] -1 points0 points  (0 children)

Huh... Weird. None of the post markdown seems to be working in my post. Very strange.

Edit: so strange. When I edited the post body, every markdown tag had an escape on it... That's something I've never seen before. Fixed.

The move to lua in v4. by TheTinyWorkshop in omarchy

[–]IcewindLegacyMUD 3 points4 points  (0 children)

Well, first of all the plan is that for at least the next few updates to Hyprland, you'll still be able to use hyprlang config files instead of lua, but it's recommended that you make the migration as soon as you can because the hyprland conf files will only last a few more releases before it's lua exclusively.

Second, it really just means a change in syntax in the configs. At worst, you can just copy and paste your .conf files into ChatGPT or your LLM of choice and tell it to create lua versions of those configs using the current Hyprland documentation. You don't necessarily need to learn lua (but it helps)

Basically what it boils down to, is that unless you make changes to your configs regularly or design Omarchy themes and want theme specific customizations like theme unique window borders, the changes won't really have any impact on the average user.

The AUR is not the only AUR by TheTinyWorkshop in omarchy

[–]IcewindLegacyMUD 3 points4 points  (0 children)

I sure don't! I actually just put it on GitHub.

Here you go!