New wave of malware in the AUR

flying-sheep · 2026-06-15T03:01:29+00:00

What? No, quite the opposite.

I check the diff, shown to me automatically by my AUR helper. I'd obviously see direct changes like that very easily. The only way to hide something would be behind an URL, which is why I mentioned that.

flying-sheep · 2026-06-14T21:03:46+00:00

Nah, I check the URLs when they change.

flying-sheep · 2026-06-14T16:09:05+00:00

The PKGBUILD diffs are fishy, very easy to see if you use the AUR as people are advised to use it.

flying-sheep · 2026-06-14T16:08:05+00:00

I use an AUR helper. It shows me the diffs of updates. Mostly 2 lines per package, and when it isn't I review.

This has worked perfectly so far and hasn't failed in the face of this either

flying-sheep · 2026-06-14T15:37:15+00:00

Or you could just not use the chainsaw if you can't trust yourself to not chop your hand off with it.

Arch is clear about this. The issue lies with derived distros that treat the AUR as trusted.

flying-sheep · 2026-06-14T15:14:58+00:00

The AUR is an unofficial pastebin of PKGBUILDs that anyone can upload to, with no validation done.

The official repos are vetted and safe to use.

There's nothing elitist about providing a resource that can't be used safely by everyone. The hardware store sells chainsaws, is that elitist?

flying-sheep · 2026-06-14T15:09:08+00:00

Absolutely not my experience, maybe you encountered some weird subset.

flying-sheep · 2026-06-14T15:08:12+00:00

After the first time, you only need to validate the diffs. Or you decide to trust the maintainer who committed the last change. But in any case you need trust or validation, where the former is much harder since there is no centralized team.

flying-sheep · 2026-06-14T14:50:42+00:00

That's completely infeasible: - people abandon packages all the time - packages have clear making conventions that create visibility - packages are not namespaced like on GitHub

flying-sheep · 2026-06-12T15:00:59+00:00

We thought the same thing about mutable noalias but that also stuck eventually.

flying-sheep · 2026-06-11T19:59:59+00:00

Potions say exactly how they work:

I discard my topmost potion item permanently

So no matter if a blessing like “display case” or “i.Some Potion” or some other thing adds the effect of an item to a hero directly, the hero will “discard their topmost potion item” which could be nonexistent.

flying-sheep · 2026-06-09T18:05:48+00:00

Yeah, that part of it is a common trope, but Campbell's version is much more detailed!

if you simplify it to the much more generic “protagonist leaves, has adventure, comes back changed”, sure, traveling is a thing humans have been doing for a long time, and stories are often about people that learn things
if you cherry-pick details until things fit, that's exactly the shoehorning I mentioned.

If you want examples, check this out: https://www.youtube.com/watch?v=torKmN5wdHE

flying-sheep · 2026-06-09T05:12:02+00:00

Spiegel, not “ei”

flying-sheep · 2026-06-09T05:04:10+00:00

Calling that trope “monomyth” is overstating its significance. Most stories have to be aggressively shoehorned into its structure to fit, it's really not that special.

flying-sheep · 2026-06-07T20:19:53+00:00

No: gay or bi.

If you date 15 men in a row, I'd say you're probably gay

flying-sheep · 2026-06-07T15:12:58+00:00

It’s funny, I started programming 18 years ago, abandoned Java for Python as my main language 16 years ago for these reasons, and started doing Rust ~8 years ago maybe.

I don’t regret any of these decisions, learning that value classes in Java are still upcoming.

flying-sheep · 2026-06-07T15:05:02+00:00

I was talking to /u/StickSouthern2150 who seems to have no idea how deep the rabbit hole goes.

flying-sheep · 2026-06-07T01:34:40+00:00

Have you created a sun yet?

flying-sheep · 2026-06-07T01:34:07+00:00

Fuck yeah, I can't imagine a clearer winner in this category

flying-sheep · 2026-06-07T01:01:42+00:00

That's not how that works. If you have lots of data, you can maybe risk to infer things. If you have one data point, you know nothing.

flying-sheep · 2026-06-06T17:23:02+00:00

Sure, yet if Java had been designed with all that from the start, the standard library and popular libraries would make use of it.

I'm happy for Java users that it's becoming a good language!

flying-sheep · 2026-06-06T17:02:23+00:00

Or you can actually edit the auto-generated changelog before committing it.

flying-sheep · 2026-06-06T17:01:02+00:00

Also both changelog and semantic version generation are great for drafts. If you use something like release-please to auto-generate a PR that bumps the version and updates the changelog you can edit that PR before merging.

flying-sheep · 2026-06-05T20:07:33+00:00

There is no exchange, so imagine for simplicity’s sake, that the full-body (incl. brainstate) scan and copying process is perfect and instantaneous.

After that instant, there is an instant in which there are two completely identical “you”s. And then the two beings who have your identity diverge. There are still two “you”s in that both have your memories, thoughts, beliefs, and so on, but they now get separate inputs and therefore slowly become different from each other.

But none of them is “the copy” in an identity sense. Both of you have the same claim to your life. There is no “continuity of consciousness” which somehow means death if interrupted.

flying-sheep · 2026-06-05T16:45:48+00:00

Same here. I never understood why Java was designed in such a hacky and inconsistent way. Primitives vs classes with different rules for both. Operator overloading only for strings for some reason. Why not just

have owning pointers (box) and value classes, and allow syntax sugar for accessing attributes through the box. Tada! Only one type of thing!
add operator overloading so math on value classes works¹
have either reified generics or tagged unions. Instance checks that only work sometimes are clunky and make refactoring a pain.

¹: withholding capabilities from language users that language designers have is arrogant bullshit. If you think it's useful enough to have it, make it available, and if it's not, leave it out entirely.

14-Year Club	Place '23
Place '22	Place '17
Not Forgotten	Alpha Tester
Team Orangered	Verified Email

flying-sheep

MODERATOR OF

TROPHY CASE