kumi

joined 1 week ago
[–] kumi@feddit.online 5 points 4 days ago* (last edited 4 days ago) (2 children)

Read https://wiki.archlinux.org/title/Arch_User_Repository

"Installing from the AUR" usually means:

  • Cloning the AUR repo
  • Installing build dependencies
    • If any of those are AUR packages, recursively repeat
  • Download source files from arbitrary online location
  • Run arbitrary commands to build
  • Pack it all into a tarball
  • pacman -U the tarball

Anyone can easily register and upload AUR packages in seconds or minutes.

This makes it a high-risk vector for malware and there is indeed malware uploaded to the AUR all the time. Looking at the NPM malware development, the increased popularity of Linux, and the already ongoing cyberattacks on AUR itself, this will only get worse.

The idea is that you are expected to manually inspect and vet the PKGBUILD yourself by doing these steps before you run makepkg itself. With great power comes great responsibility. Developers realize that it is not responsible to make a tool specifically designed to make dangerous behavior and explicitly bypassing safeguards, stopgaps and best-practice protocols more convenient than the alternative, when it will be targeted to uneducated users.

As wltr mentioned, there are helpers, but you really should pick one that involves that manual inspection (like aurutils), and after becoming comfortable enough with git+makepkg+pacman to make it routine.

TLDR: If you can't or won't vet PKGBUILDs of AUR packages you shouldn't be blindly installing them.

[–] kumi@feddit.online 1 points 4 days ago

I am referring to the ARM Steam Machine next to the x86 Steam Deck handheld.

[–] kumi@feddit.online 2 points 5 days ago* (last edited 5 days ago)

Another thing they may have in mind is ATX PSUs. The pinouts on those for the same physical plug vary not only by maker and model but sometimes even by year. So if you get an aftermarket ATX-to-SATA cable that fits just fine in the SATA plug on your ATX PSU, it may put 12v on the 5v and fry your drives or mobo when you plug it in even if it's from the same brand.

Don't ask me why there is a voltmeter on my desk.

[–] kumi@feddit.online 1 points 5 days ago

The reason you don't hear much is because they usually Just Work.

[–] kumi@feddit.online 3 points 5 days ago (2 children)

And Steam shipping an ARM desktop alongside their x86 handheld.

[–] kumi@feddit.online 7 points 5 days ago* (last edited 5 days ago) (1 children)

I think that might be the same RK3588 chip as the Bananapi M7 which I did a write-up on last year. Trying a different kernel might help with your issue - it did for me.

https://blog.kumio.org/posts/2025/01/bananapim7-hvm.html#kernel-versions

I should probably update the table for trixie.

[–] kumi@feddit.online 23 points 5 days ago (3 children)

Terrible headline. Should have just been "Rockchip has...".

Am I showing my age if I say that Tomshardware used to be decent?

[–] kumi@feddit.online 1 points 5 days ago* (last edited 5 days ago) (1 children)

Personally I'm too paranoid about security and sus of Intel to be comfortable with vPro but you do you.

That said, I'd go for 1, considering you already have that 6th gen on hand in case you need a spare.

Otherwise 3 or 4 (whichever is available on secondary markets for a decent price) and hang on to that Pentium in case need arises. Doesn't sound like the extra power draw of an i7 is worth it for this build.

[–] kumi@feddit.online 3 points 5 days ago (1 children)

Up to 300 or so could be reasonable if the RAM and SSD are decent.

[–] kumi@feddit.online 1 points 5 days ago* (last edited 5 days ago)

No one talks about how Alpine has been doing immutable and atomic installations since way before it was trendy.

https://wiki.alpinelinux.org/wiki/Immutable_root_with_atomic_upgrades

view more: ‹ prev next ›