News that might affect BunsenLabs

PackRat · 2026-05-19 22:20:49

Potential to effect every distro:

MS Linux

https://www.zdnet.com/article/microsoft … linux-4-0/

johnraff · 2026-05-20 02:46:48

^interesting!

Pinhead · 2026-06-14 10:48:36

There is a New X11 Server, Written in Rust, With the Help of AI

hhh · 2026-06-14 16:11:01

Anyone know why Arch is getting targeted for exploits all of a sudden?

https://thehackernews.com/2026/06/over- … s.html?m=1

PackRat · 2026-06-14 16:33:06

hhh wrote:

Anyone know why Arch is getting targeted for exploits all of a sudden?
https://thehackernews.com/2026/06/over- … s.html?m=1

Because they can would be my guess. The AUR has a large user base and has always been a relatively easy and tempting target. Maximum damage.

And it's worth noting it's not Arch per se that is having issues, it's the AUR. The Arch devs have always been quick to point out the risks:

The AUR is just popular with a lot of users that treat it like just another repo; and the AUR helpers make it easy to use.

Similar mindset in users that add a ppa to Ubuntu, or worse, Debian and start installing packages.

hhh · 2026-06-14 17:58:52

I see. I always wondered about AUR security, but to be fair the users are quite savvy which is why this was caught so quickly.

Sonatype's first write-up counted more than 20 hijacked packages. Within a day, community trackers and the Arch aur-general thread had cataloged over 400, with one master list compiled by grepping the AUR git mirror, putting it around 408, and consolidated lists climbing higher.

PackRat · 2026-06-14 18:54:18

hhh wrote:

I see. I always wondered about AUR security, but to be fair the users are quite savvy which is why this was caught so quickly.
Sonatype's first write-up counted more than 20 hijacked packages. Within a day, community trackers and the Arch aur-general thread had cataloged over 400, with one master list compiled by grepping the AUR git mirror, putting it around 408, and consolidated lists climbing higher.

I don't think that's valid any more; their userbase isn't much different than any other distro these days. Maybe back when #! was popular and Arch was the distro for intermediate/advanced users. The rise of the user-friendly Arch installers and AUR helpers really increased the access for everyday users. The usual dual-edged sword argument; both the savvy and non-savvy could get an Arch system installed no problem and then start installing from the AUR. Even the popular Arch-based Manjaro has unintentionally borked the AUR a couple of times. Imagine if they tried.

hhh · 2026-06-14 19:53:22

You're validating why I never used Arch. Aside from the pain of installing the thing.

I did like using Paru for the AUR, very easy.

johnraff · 2026-06-15 01:33:26

Pinhead wrote:

There is a New X11 Server, Written in Rust, With the Help of AI

Interesting, though time wil tell if it's a new road or just a temporary side-alley.

itsfoss wrote:

...shows us how prevalent vibe coding has become, whether you like it or not

...a significant number of "not" votes, probably.

johnraff · 2026-07-13 00:58:40

Security support for Bookworm handed over to the LTS team
https://www.debian.org/News/2026/20260712

BL Boron users take note - Debian support has switched to Long Term Support, which will continue till 30 June 2028.

Beryllium users (Debian 11 "Bullseye") should upgrade to Boron before 31 August 2026, and then preferably to Carbon .

hhh · 2026-08-01 18:34:30

Not BL, but the entire Arch AUR has been temporarily disabled due to a massive malware attack...

https://www.bleepingcomputer.com/news/s … are-flood/

Döbbie03 · 2026-08-01 19:19:29

Well, not so much disabled the AUR but disabled adoption of orphan packages which is where the malware was coming from.

hhh · 2026-08-02 02:07:04

I see. The news was vague.

Döbbie03 · 2026-08-02 02:16:52

Basically an orphaned package can be picked up by anyone. No checks, no security nothing. So imagine you've had an older package working perfectly fine without an update for years and then boom! Yay and update.

An update with a surprise, a surprise you aren't going to like.

hhh · 2026-08-02 03:16:11

Yeah. Never got into it, I appreciate Debian more everyday.

johnraff · 2026-08-14 08:45:31

lightdm upgraded

Good news - a few days ago lightdm 1.33 was released and it's already in Debian Forky so we'll have it by default for BL Nitrogen.
This was a surprise because it seemed to be fading into oblivion over the last few years, but it's been taken over by developers Joshua Peisach and Neal Gompa, and the Debian maintainer Yves-Alexis Perez has been very swift to get it in the repos for us.

https://ubuntuhandbook.org/index.php/20 … ar-hiatus/

I've built 1.33 from the Debian source, and plan to install it locally. If no problems turn up I'll put it in carbon-backports for those who want it.

hhh · 2026-08-14 23:08:33

^ Saw this via omgubuntu.com yesterday and it is good news!

+1 to a BL nitrogen backport.

johnraff · 2026-08-15 00:59:44

^Nitrogen won't need a backport because it's already in Forky, but I'm using 1.33 right now in my working Carbon machine and if there seem to be no issues I can easily upload it to the Carbon backports repo (confusingly named "trixie-backports") for current users.

To be honest, I'm not noticing any particular differences so far, but the changelog shows a lot of small stuff that might fix corner issues for some people.

Anyway it's good to know that lightdm is still being looked after.

#301 2026-05-19 22:20:49

Re: News that might affect BunsenLabs

#302 2026-05-20 02:46:48

Re: News that might affect BunsenLabs

#303 2026-06-14 10:48:36

Re: News that might affect BunsenLabs

#304 2026-06-14 16:11:01

Re: News that might affect BunsenLabs

#305 2026-06-14 16:33:06

Re: News that might affect BunsenLabs

#306 2026-06-14 17:58:52

Re: News that might affect BunsenLabs

#307 2026-06-14 18:54:18

Re: News that might affect BunsenLabs

#308 2026-06-14 19:53:22

Re: News that might affect BunsenLabs

#309 2026-06-15 01:33:26

Re: News that might affect BunsenLabs

#310 2026-07-13 00:58:40

Re: News that might affect BunsenLabs

#311 2026-08-01 18:34:30

Re: News that might affect BunsenLabs

#312 2026-08-01 19:19:29

Re: News that might affect BunsenLabs

#313 2026-08-02 02:07:04

Re: News that might affect BunsenLabs

#314 2026-08-02 02:16:52

Re: News that might affect BunsenLabs

#315 2026-08-02 03:16:11

Re: News that might affect BunsenLabs

#316 2026-08-14 08:45:31

Re: News that might affect BunsenLabs

#317 2026-08-14 23:08:33

Re: News that might affect BunsenLabs

#318 2026-08-15 00:59:44

Re: News that might affect BunsenLabs

Board footer