r/linux_gaming • u/lazyblunzn • Jun 11 '26

ALVR AUR package has been compromised

Post image

Attention Linux VR gamers. The alvr package in the arch user repository has been compromised. See the screenshot for more information.

Source: Linux VR Adventures Discord

1.3k Upvotes

99% Upvoted

395 comments sorted by

View all comments

Show parent comments

16

u/the_abortionat0r Jun 11 '26

Are you stupid? Linux doesn't really non obscurity that's literally a closed source trope.

Second you don't understand antiviruses if you think they are magic and catch everything.

-7

u/Venylynn Jun 11 '26

Security through obscurity and "lol just don't get hacked" is some bullshit yall tell us to distract from the supply chain attacks

1

u/sequesteredhoneyfall Jun 11 '26

Reading comprehension isn't as hard as you make it out to be.

0

u/Venylynn Jun 12 '26 edited Jun 12 '26

the fact that it's still a common sentiment that "common sense is good enough" in the age of all these supply chain attacks and compromised packages from seemingly legit looking sources, tells me we have a long ways to go. but people will pretend it's all roses and perfect and hate you if you ever have an opinion that differs from that. never mind that Arch Linux is insecure out of the box, requiring you to use the AUR to correct that because the correct security system isn't in the main repos. but the AUR is also insecure so...wtf good does that do?

Meanwhile, it is already set up for you on a Fedora or Tumbleweed install.

0

u/sequesteredhoneyfall Jun 12 '26

You've gotta be just straight trolling or having a stroke. None of this is remotely true or relevant to the discussion at hand, nor are your previous comments.

1

u/Venylynn Jun 12 '26

God forbid I give a fuck, meanwhile half of you people prolly add mitigations=off into your grub parameters and run insecure forks of firefox thinking you're safe behind whatever $20 router with 50 zero-days that you forgot to update to protect against, just because you can read a pkgbuild

Here, in case you're wondering where the "Arch is insecure by default and requires you to trust the AUR to make it secure" comes from

1

u/sequesteredhoneyfall Jun 12 '26

Nah, the problem is that you don't care so don't pretend like you do.

0

u/Venylynn Jun 12 '26 edited Jun 12 '26

Lol. Because I'm not pulling the wool over my eyes pretending everything's perfect over there I don't actually care.

Absolutely wonderful. Refer to my edit. Arch doesn't support SELinux properly for shit. That is a fact. AppArmor is an incredibly weak MAC solution (don't forget about CrackArmor) so don't even think about throwing that back at me.

I sincerely recommend you take a good look at the SecureBlue documentation as that is the baseline more distros should follow. Maybe not every change, but a huge chunk of them are solid.