| ▲ | delta_p_delta_x an hour ago | |
> Another win for the Linux security model I swear, OSs have become sports teams. Linux's 'security model’ has plenty of holes. The very fact the kernel and much of its user-mode is written in C almost guarantees that its security model is worthless. The Linux ecosystem operates on trust and respect that can and has been easily abused by bad actors to provide supply-chain pwnage. There have been so many zero-click local privilege escalation CVEs I've lost track. Arch Linux AUR malware: https://lists.archlinux.org/archives/list/aur-general@lists.... | ||
| ▲ | silver_silver an hour ago | parent | next [-] | |
AUR is an effectively unmoderated user repo. It’s not Arch Linux’s core repository, nor is it enabled by default or indeed even possible to use without manual downloads from outside the package manager. | ||
| ▲ | opan an hour ago | parent | prev [-] | |
I think you can probably find a better example, even if less recent. The AUR is unofficial and not properly vetted in the same way as the actual Arch repos, Debian repos, etc. | ||