Japanese diplomats told company risk officers that “you are on your own if you put significant assets in Taiwan”, said one person present at one of the conversations.
Foreign direct investment by Japanese companies — traditionally Taiwan’s third-largest source of FDI, after the EU and US — slumped 27 per cent last year to $452mn, and is down from a peak of $1.7bn in 2022.
Japanese diplomats told company risk officers that “you are on your own if you put significant assets in Taiwan”, said one person present at one of the conversations.
Foreign direct investment by Japanese companies — traditionally Taiwan’s third-largest source of FDI, after the EU and US — slumped 27 per cent last year to $452mn, and is down from a peak of $1.7bn in 2022.
fixed issue with 32 bit applications needing wow64 when using ntsync, no longer need to enable wow64 for ntsync
ntsync now enabled by default, will be used if kernel supports it
sdl will automatica...
This thing turned out ot be overrated and useless, just like Steam itself. I lost count of how many games won't run with any proton (GE included), whereas they run just fine with my highly customized wine 10.5.
I had one of these I got it around 15ya but I never used it. I remember liking a particular aspect of it as if I had a specific use-case in which it would be handy but I can't remember what that was.
Anyways, I've been on the keepass bandwagon through multiple reboots of it's software lineage along with Keepass2Android and I am satisfied.
we might laugh at this but I think this is useful. Even though I wouldn't use something like this and I'd just use a regular dedicated blank notebook and my password manager, it can be useful to people who have problems with computers and can't handle a password manager, yet may give pages with good templates to show how to record sensitive information.
I should get this for my dad, he recently got a new computer at best buy and the geek squad told him his files were all in the cloud and sent him home. Guess who got a call the next day because "all my passwords are in a word document in some fucking cloud". Yeah that was a fun day spent setting up his computer while listening to his rant about the geek squad and "the fucking cloud".... thanks geek squad....
As a software engineer who values humanity has done a good bit of work with "the cloud", i think your dad has the right set of feelings towards the cloud. That fucking cloud can go get bent
Having looked at various browsers and what calls they make, I noticed on Firefox and other android browsers that when Bypass Paywall Clean is installed from main source: gitflic.ru/project/magnolia123…
It makes calls to gitflic.ru quite often wether using a bypass website or not.
Anyone know on what the calls are about and if they are legitimate and or what telemetry is being shared?
Japanese diplomats told company risk officers that “you are on your own if you put significant assets in Taiwan”, said one person present at one of the conversations.
Foreign direct investment by Japanese companies — traditionally Taiwan’s third-largest source of FDI, after the EU and US — slumped 27 per cent last year to $452mn, and is down from a peak of $1.7bn in 2022.
Sensible. Each company should prepare it's own risk assessment and manage the risk. Taxpayers shouldn't have to bail them out for their stupid/greedy decisions.
The Rockchip Developer Conference 2025 (RKDC!2025) is now taking place in Fuzhou, China, with some interesting announcements such as the Rockchip RK3668 10-core Arm Cortex-A730/A530 processor with a 16 TOPS NPU and the RK182X RISC-V co-processor with support for up to 7B parameters LLM (large Language Model)or VLM (Vision Language Model).
I've always said. It's not good that cloudfare (or any single entity) "owns" half the internet.
For my self hosted stuff I refuse to use their services. I prefer to invest a little more time securing it from my side instead of giving them more control over internet.
It's not good that cloudfare (or any single entity) "owns" half the internet.
100% this^. Even if they aren't actively doing anything terrible that we know of, it still totally undermines people's privacy, even those of us who try to be careful about that sort of thing. Cloudflare is fingerprinting you when you visit sites that use their services for security, and like google, their sheer ubiquity across the web means they can effectively watch and track you wherever you go.
More and more I've been running into the full-page error "please unblock challenges.cloudflare.com to proceed" while just browsing around the web. A site is completely locked to any user who runs into this error; it's not just a popup notification, its a blank page with nothing but the error message and the only way to "fix" it is to whitelist their fingerprinting scripts. I use extensions like uBlock Origin of course, but for more fine-tuned script blocking, also uMatrix, so it's usually because of one of those that I get the cloudflare error. I could of course whitelist it, but I never do, I just decide that page is not worth my time. But it's getting harder to stick with that principle as I run into it more all the time, even for sites that it never used to be an issue. It's also part of why it keeps getting more difficult to browse the web with TOR browser.
Fuck cloudflare. They've wormed their way into most of the web now but they've managed to do it in a quiet way that usually goes unnoticed if you're not a privacy nerd. Everyone knows google and amazon are evil and do all that they can to track anything and everything people do, but cloudflare is becoming just as insidious.
The European Commission paid €360,000 (about $428,000) for a study on how piracy impacts the sales of copyrighted music, books, video games, and movies.
I can understand why they decided to not publish the result. I live in Spain, I have no clue how is it in other European countries but here it's like they only take any action when something becomes very widespread or touches the football.
So it is a bit like as they read the report and decided to not spend too much on that.
Literally if not for music piracy I wouldn't have a massive vinyl library worth > $7,000, wouldn't have gone to 100+ live shows, wouldn't have paid $1000+ bucks for all the band merch I have, wouldn't have evangelized countless bands to all of my friends and social network for decades. Piracy is absolutely the thing that unlocked that whole obsession for me.
I would only download stuff I wasn't going to buy anyway, but if I do actually like it enough I then go and buy it, except if it's Nintendo. They can go fuck themselves in every way possible.
I appreciate that your title makes it clear that this is an old article. Certainly it's still relevant, but going into the article with knowledge of its age calibrates my mindset
I have purchased far more than I've ever obtained. In some cases I've double dipped and purchased multiple times.
The main issue is "can I obtain it legally and pay the original creators?" And secondary is "is this item reasonably priced and delivered in an accessible way?".
The last game I grabbed was the Sims 4 + dlc a very very long time ago. The last show i grabbed was probably an anime with fan subtitles.
Hey there, I'm trying to launch RDR2 on PC and keep getting this error message:\ "Red Dead Redemption 2 exited unexpectedly! Please visit support.rockstargames.com/ for more information."
So does someone knows how to fix it. I have read many forums and have watched many yt videos but nothing helped.
I have installed graphics tool from windows settings, updated my intel and nvidia graphics, disabled antivirus, set the .exe file to open by default on administrator mode, installed a certain mod type file and placed it inside the folder (a old reddit thread recommends that) and installed the vulkan.exe which was inside the rdr2 folder
After a ProPublica investigation revealed how Microsoft’s “digital escort” tech support service could expose sensitive government data to cyberattacks, the company says China-based engineers will no longer provide assistance on DOD cloud services.
Il primo bombardamento di Roma avvenne il 19 luglio 1943, durante la seconda guerra mondiale, ad opera di bombardieri statunitensi delle forze aeree alleate del Mediterraneo. Il quartiere San Lorenzo fu duramente colpito dalle bombe.
Pio XII in visita alla Basilica di San Giovanni in Laterano il 13 agosto 1943, in occasione del secondo bombardamento di Roma
Dopo un triennio di ipotesi intorno all'inserimento della capitale italiana nel novero degli obiettivi aerei alleati, San Lorenzo fu il quartiere più colpito dal primo bombardamento degli Alleati mai effettuato su Roma, insieme al Tiburtino, al Prenestino, al Casilino, al Labicano, al Tuscolano e al Nomentano. Le 4.000 bombe (circa 1.060 tonnellate) sganciate sulla città provocarono circa 3.000 morti e 11.000 feriti, di cui 1.500 morti e 4.000 feriti nel solo quartiere di San Lorenzo.
Al termine del bombardamento papa Pio XII si recò a visitare le zone colpite, benedicendo le vittime sul Piazzale del Verano.
Tra i soccorritori morti (morirono ventiquattro vigili del fuoco) anche il comandante dei carabinieri generale Azolino Hazon, accorso sul posto.
Normally I use NewPipe on android. It's an alternative YouTube app that can play videos in the background, doesn't have ads and allows me to download videos and music.
I had the YouTube app disabled with adb on this phone for all the time I've had it. For backup there's always the browser YouTube page.
I must have done something wrong and accidentally clicked install on the YouTube app again, so it activated and was back to normal on this phone.
Holy hell is that app a terrible advertising machine. Every time I click on a YouTube video now I get sent straight to it and it always plays ads and also has text ads all over the GUI so I can't even read the channel info etc while I wait for the ads to go away.
I don't know how people deal with that it would completely make me want to stop using YouTube.
Please do yourself a favor and install NewPipe or ReVanced (I think that's the name of basically the same app but with sponsorblock additionally). Both are on f-droid.org app store as well. Less important because you can manually use NewPipe but you could also disable the YT app with adb so it disappears from your phone.
Forti mura grigie costruite sulla base del criterio di resistenza. Dove domina la forma di montanti parabolici ed interconnessi, traforati per permettere alla luce di passare attraverso.
Amri Wandel kaj François Lo Jacomo rekandidatis por la nova estraro de UEA, sed ne eniris la proponon de la elekta komisiono. Ambaŭ tamen en retmesaĝoj petis subtenon de la komitatanoj. La elekto do ne estos senalternativa, ĉar jam estas 11 aktivaj kandidatoj por maksimume 9 lokoj. Tamen preskaŭ certas, ke Fernando Maia iĝos la sekva prezidanto.
Hey y’all, I know getting a setup that feels “right” can be a process. We all have different goals, tech preferences, etc.
I wanted to a share my blog post walking through how I finally built a setup that I can just be happy with and use. It goes over my goals, requirements, tech choices, layout, and some specific problems I’ve resolved.
Where I’ve landed of course isn’t where everyone else will, but I hope it can serve as a good reference. I’ve really benefited from the content and software folks have freely shared, and hope I can continue that and help others.
Bookmarked to read later. Lots of interesting stuff that I've heard before (Tailscale, local auth, etc.) that I really need to consider for my own homelab.
The following is an essay that first appeared in the July 24, 2025, issue of the London Review of Books (LRB), a prominent literary journal based in London, United Kingdom.
The author of the article is Adam Shatz, LRB’s U.S. editor. Shatz is also a contributor to The New York Times Magazine, The New York Review of Books, The New Yorker, and other publications. He is a visiting professor in the Human Rights Program of Bard College in New York.
In this essay, author Adam Shatz raises important issues that deserve further discussion in light of the gruesome October 7, 2023, attack led by Hamas that targeted civilians in Israel, the genocidal war Israel unleashed in retaliation on the entire …
This is the first time Californians have seen this level of transparency about Caltrans projects. Statewide, 13 projects completed between 2018 and 2023 resulted in more than 620 home and business needing to be relocated.
Profitez des vidéos et de la musique que vous aimez, mettez en ligne des contenus originaux, et partagez-les avec vos amis, vos proches et le monde entier.
It’s 2025. Israeli soldiers are telling the Israeli press that they’re being ordered to massacre starving civilians trying to obtain food from aid centers. Countless doctors have been telling the world that Israeli snipers are routinely, deliberately shooting children in the head and chest throughout the Gaza Strip. Amnesty International, Human Rights Watch, and all the leading genocide experts and human rights authorities are saying that a genocide is being perpetrated in Gaza. The New York fucking Times just published an op-ed by a Zionist genocide scholar who’s finally admitting that it’s a genocide.
There’s no way to deny what this is anymore. If you still support Israel in the year 2025, it’s not because you don’t believe Israel is committing horrific atrocities. It’s because you believe those horrific atrocities are good, and you want to see more of them.
If You're Still Supporting Israel In 2025, There's Something Wrong With You As A Person
by Caitlin Johnstone Jul 18, 2025
It’s 2025. Israeli soldiers are telling the Israeli press that they’re being ordered to massacre starving civilians trying to obtain food from aid centers. Countless doctors have been telling the world that Israeli snipers are routinely, deliberately shooting children in the head and chest throughout the Gaza Strip. Amnesty International, Human Rights Watch, and all the leading genocide experts and human rights authorities are saying that a genocide is being perpetrated in Gaza. The New York fucking Times just published an op-ed by a Zionist genocide scholar who’s finally admitting that it’s a genocide.
There’s no way to deny what this is anymore. If you still support Israel in the year 2025, it’s not because you don’t believe Israel is committing horrific atrocities. It’s because you believe those horrific atrocities are good, and you want to see more of them.
It’s 2025. Israeli soldiers are telling the Israeli press that they’re being ordered to massacre starving civilians trying to obtain food from aid centers. Countless doctors have been telling the world that Israeli snipers are routinely, deliberately shooting children in the head and chest throughout the Gaza Strip. Amnesty International, Human Rights Watch, and all the leading genocide experts and human rights authorities are saying that a genocide is being perpetrated in Gaza. The New York fucking Times just published an op-ed by a Zionist genocide scholar who’s finally admitting that it’s a genocide.
There’s no way to deny what this is anymore. If you still support Israel in the year 2025, it’s not because you don’t believe Israel is committing horrific atrocities. It’s because you believe those horrific atrocities are good, and you want to see more of them.
Not gonna lie, I feel like 2025 is way too generous. The only reason so many people are suddenly opposing Israel is because the overturn window has shifted and it is no longer popular to support Israel.
imo i wouldnt say it’s about popularity and more about israel just being unable to really hide what they’re doing anymore. now its at the point where your average apolitical normie is seeing babies get their limbs blown off on their tiktok feed.
they had a lot more plausible deniability before their genocide was being live streamed.
as long as leftists have known about how fucked up israel is, your average truly “apolitical” person only knew the israel propaganda painted about it. now they see thats not true and thats a good thing
'Normies' have been seeing babies limbs getting blown off since 2023. They simply chose to ignore it because the public sentiment opposed it. The average person is a literal NPC who will repeat whatever the media tells them even if the video footage gets shoved in front of their eyes. I've tried it.
Even now, if you ask them if Israel has a right to exist they will answer yes. Knowing that Israel is comparable with Nazi Germany. They would tell you that Nazi Germany has a right to exist if that is what the media told them.
i think that’s pretty pessimistic towards your average person
with how alienated capitalism keeps us all from our peers, its easy to forget that you and i are also just average people.
we’re half way into 2025. gaza videos didnt really become widespread in people’s feed til about a year ago. thats when apolitical people would have started seeing this so much. the amount of turn around in just that small period of time is a good thing and being pessimistic about it or writing people off as lemmings because they were tricked by propaganda designed specifically to trick people specifically like them isn’t helping anyone. that’s just you projecting your resentment towards people, and im not saying that as an insult. its easy to resent them. dont let your resent control you tho.
its really not as simple as that lol. you’re letting your disdain towards people personally steer your point of view.
your average person had no idea this was happening until recently and once they saw it they said it was bad.
its extremely easy to fall into your line of thinking when you don’t interact with your community and view yourself as an individual against other individuals. thats the framing capitalism has given you but its a false framing.
i can tell you for a fact; i live in a small town in georgia. 3 years ago nobody here knew shit about israel or palestinine. went to two protests in the last two months, both FULL of support for palestine. people who have passively said positive things about israel to me who didnt know better have now said they had no idea what was happening over there. that they literally didnt even know what “gaza was” until recently
sadly thats where your average person is at.
they are not as “genocide is good”.
they’re at “i heard israel was good”. sadly thats more affective than it should be.
but to just write everybody off as wrong and having these horrible opinions is just anti leftwing tbh. you will never create any sort of left wing anything if this is how you view your fellow worker. not everybody is a leftist and in fact most people think we’re fucking crazy, for the same reason they used to think israel is good. “trusted sources” on tv told them so.
this doesn't really support your point, posters in an explicitly political thread on a very niche social media platform aren't going to be representative of the average
"everybody supports genocide but like 3% of the population that identify as marxists" is an unhinged view of the world and i really hope you touch grass for everybody's sake
After years of innovation and community collaboration, we’re ending support for Clear Linux OS. Effective immediately, Intel will no longer provide security patches, updates, or maintenance for Clear Linux OS, and the Clear Linux OS GitHub repository…
After years of innovation and community collaboration, we’re ending support for Clear Linux OS. Effective immediately, Intel will no longer provide security patches, updates, or maintenance for Clear Linux OS, and the Clear Linux OS GitHub repository…
After a ProPublica investigation revealed how Microsoft’s “digital escort” tech support service could expose sensitive government data to cyberattacks, the company says China-based engineers will no longer provide assistance on DOD cloud services.
Tensions in the Philippines have recently been raised over the country's South China Sea policy, after a retired officer criticized Manila's current approach as making the country a US pawn and even
The Environmental Protection Agency said Friday it is eliminating its research and development arm and reducing agency staff by thousands of employees.
The agency’s Office of Research and Development has long provided the scientific underpinnings for EPA’s mission to protect the environment and human health. The EPA said in May it would shift its scientific expertise and research efforts to program offices that focus on major issues like air and water.
On the 16th of July, at around 8pm UTC+2, a malicious AUR package was uploaded to the AUR. Two other malicious packages were uploaded by the same user a few hours later. These packages were installing a script coming from the same GitHub repository that was identified as a Remote Access Trojan (RAT).
The affected malicious packages are:
librewolf-fix-bin
firefox-patch-bin
zen-browser-patched-bin
The Arch Linux team addressed the issue as soon as they became aware of the situation. As of today, 18th of July, at around 6pm UTC+2, the offending packages have been deleted from the AUR.
We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised.
Follow up
There are more packages with this malware found.
minecraft-cracked
ttf-ms-fonts-all
vesktop-bin-patched
ttf-all-ms-fonts
What to do
If you installed any of these packages, check your running processes for one named systemd-initd (this is the RAT).
This is why I felt uncomfortable when I first switched to Linux and kept reading that I didn't need to worry about viruses as long as I didn't click on dodgy links and only installed from trusted sources. I'm sure I'm betraying my lack of security knowledge here, but that always seemed a bit too easy.
The "Arch cult's" holy book, the ArchWiki, states the following pretty clearly:
Warning: AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.
Mention of one's use of the AUR for their needs doesn't need to come with a disclaimer. People who don't read or don't use their brain are going to keep not doing so, regardless.
I feel like the people who don't look at PKGBUILDs and install hooks and just hit Y on everything are the same people who spam "Next" and "Accept" on Windows Installers from random websites.
You can't even install from AUR using pacman directly. You either need to makepkg them manually, or use an extra AUR compatible package manager like yay. It's made as clear as possible to arch users that the AUR is not vetted in any way, it's just for convenience.
The AUR, key words “user repository” is a specific weak point. It doesn’t have the same level of oversight that the main arch repo has. Stick to main repos and verified flatpaks and it’s very unlikely that you’d ever be compromised.
Linux isn’t perfect, but it’s certainly better than windows where you just download executables willy nilly to install your software.
BTW python's package index has roughly the same problem - but a far less technical, experienced and critical user base. NPM has this problem since years.
Expect these problems to rise with every percent more of new Linux users which never learned the difference between opening / viewing untrusted data, and running untrusted code, because Windows basically ignores this essential concept and Android tries to solve that with sandboxing each app.
That is sound advice, the AUR is most definitely not a trusted source though. For the normal arch repos the people who put the stuff there are known, they work for the project, you're as likely to get malware from one of those as you are to read an article bashing gamespot in gamespot, the people in charge of putting the packages there are the ones with more vested interest in things working so they won't knowingly introduce malicious code (plus it's a handful of people who know each other by first name).
The AUR is a different story, because anyone can put stuff there it's very easy to have malicious code end up there. It doesn't happen that often because most of the time it's fairly obvious and it gets flagged straight away, plus if people start doing that people will migrate away from the AUR, so it's a high risk low reward situation. But as more and more people start to use Arch derivatives that come with the AUR enabled without understanding any of this it becomes a more rewarding thing to exploit.
like git repositories, AUR in its name itself says what it is, a User repository. its trust like repositories is fully based on how much you trust the user who uploaded it
Yeah. The I'm A Mac crowd had the same problem... god damn it, two or three decades ago.
As market share increases, platforms become a much bigger target for malware. And a lot of the "I don't need to run virus scans" crowds learn the hard way.
Its the same with open source. Obviously NOBODY around here would parrot this bullshit, but there is the idea that because something is FOSS it is safe. Code is only as safe as code review and there have been a few high profile cases of social engineering to get malicious code past even fairly rigorous review. Let alone "Well, that script is FOSS so somebody probably reviewed it" that we see so often.
The arch maintainers package more software than most other distributions. Some items they leave in the AUR by choice, if the Dev prefers it there. The key is to use the AUR sparingly and only if you trust the packager.
The arch maintainers package more software than most other distributions.
Sorry, but I fail to see this.
I suppose if you're accounting literally all independent distros, then you're probably right. However, if we'd be more realistic and compare it to other well-established independent distros^[I'm basically counting Alpine, Debian, Fedora, Gentoo, openSUSE, Slackware, Solus and Void. I didn't count Guix System and NixOS for how their 'repositories' are built different and therefore not easily comparable to the others.], then we notice that the vastness of the packages found in Arch's repository is rather lackluster at the very least. Heck, by virtually all metrics, Arch together with its derivatives undoubtedly belong in the upper echelons of usage stats; only being second to the Debian-family of distros. IMO, however, the size of its repository absolutely doesn't reflect this; as it's only bigger than Slackware, Solus and Void. The inclusion of these smaller projects is arguably charitable on my side*. But to drive the point home very clearly: Arch's repository is smaller than Alpine's, Debian's, Fedora's, openSUSE's and Gentoo's with a ratio of (about) two to one (except for openSUSE).
I don't know if raw package counts is the best comparison. Unlike say Fedora, Arch bundles everything related to a project in the same file. If you want Qt6-base on Arch, that is one package. If you want it on Fedora, it is going to have a lib, header, docs, and maybe a few other packages.
Just from personal experience, I do not have issues with finding packages in the main repos, with only a handful of my packages coming from the AUR. This is not the case with others, like Fedora where extra repos need to be added, like EPEL and RPM Fusion.
I don't know if raw package counts is the best comparison.
You're probably right. Do you think we got anything better to go by?
Unlike say Fedora, Arch bundles everything related to a project in the same file. If you want Qt6-base on Arch, that is one package. If you want it on Fedora, it is going to have a lib, header, docs, and maybe a few other packages.
Can't comment on this. Though, the list of packages with qt6 in their name is considerably longer in Fedora. However, I wonder if this simply reflects that Fedora, by virtue of having a larger repository, also has more stuff related to qt6. Or, as you posited it, chooses to package the same content over multiple packages instead of bundling them like it's supposedly happening on Arch.
Just from personal experience, I do not have issues with finding packages in the main repos, with only a handful of my packages coming from the AUR. This is not the case with others, like Fedora where extra repos need to be added, like EPEL and RPM Fusion.
Hmm..., I feel you might be conflating stuff. Please allow me to elaborate on what I mean.
Fedora is not able to include some packages in its own repository due to legal reasons. As such, these are relayed to RPM Fusion instead. Which means that a well-functioning Fedora installation (almost necessarily) desires to install some packages from RPM Fusion. So, RPM Fusion exists as a 'hack' of sorts to protect Fedora from legal charges and NOT because they're too lazy (or something) to ship those packages themselves. To be clear, RPM Fusion is accepted as a trusted third-party repository.
Arch, on the other hand, is rather lenient on what they can include in their repositories. Basically enabling them to package within their repositories all codecs and whatnot without them being visibly worried about the legal consequences of this ordeal.
To be honest, I don't know exactly where this discrepancy comes from. But I wouldn't be surprised if it's related to how Arch is basically a genuine community distro while Fedora has official ties to Red Hat.
I 100% agree. Everyone raves about the AUR but it really feels like more of a necessity than a value add because so little is actually packaged for arch. And the AUR is definitely more annoying and feels more jank than just having it in your default repo.
It has already happened a few times with other repos. Although AUR is especially susceptible because there's no vetting at all, it's a free-for-all that everyone can publish to within a few clicks. This will for sure happen again within a couple months, but better hidden the next time.
The frequency of this happening does not inform you of the risk. Because there is no attestation it could happen rarely for some time and then suddenly a lot. Or the inverse. No way to tell.
To be clear, they created new packages with these names. Anyone can make anything available on the AUR, but you cannot issue updates under someone elses existing package name.
The Arch User Repository is a way for anyone to easily distribite software.
Hence it has never been secure, and rather than claim it is, you mostly see people and documentation warn you about this, and to be careful if using it.
Any schmuck can make whatever they want available via the AUR. That's how even the tiniest niche project can often be installed via the AUR. But you trade in some security for that convenience.
It shouldn't be used as a marketplace, it should be used as a repository. You can probably find a lot of malware on GitHub, doesn't mean you go there to choose your text editor.
I never search the AUR directly, I only use it if some README tells me I can install their software via an AUR package.
Yeah, I search the AUR not to discover packages, but to see if something I want to install is in there, if it is I check the PKGBUILD and make sure none of the sources/commands/patches are suspicious. People need to remember it's not some carefully vetted app store and that they need to be the ones vetting any packages they install and any changes when updating.
What a nice attack on privacy-friendly infrastructure.
And then, Arch AUR has such suspicious things like the Brave browser which claims to reduce tracking.... and works together with advertisers.
To be clear, AUR is fantastic if you develop some experimental package and you want to give it to your friends to try it out easily. But not as a general distribution mechanism.
Wait what happens once some government or state actor hacks rust's install script rustup with its curl | bash install procedure and relying on TLS certificates which are e.g. issued by the Russian government. (No, the rust project won't use a Russian/Chinese/US Gov certificate but your browser will trust near all of them...)
You're using that to download a program. If they can MitM the shell script, they can just as well MitM the program that you'll run right after the download...
Sure, I guess, if you've got a distro installed on your PC and use the distro-provided packages to install the Rust compiler, then you can't be subject to such certificate MitM attacks.
Your comment sounded like you were primarily concerned about the shell script piping rather it just being a program which can be downloaded without going through distro packages.
Your comment sounded like you were primarily concerned about the shell script piping rather it just being a program which can be downloaded without going through distro packages.
The AUR install scripts are just downloaded shell scripts which are executed (hopefully after inspection).
curl | bash just skips the inspection step - curl downloads to stdout, bash executes from stdin.
We are getting to the point where inviting more people in means we will need an automated babysitter to watch for this shit and to pull it once it’s discovered. Apple has a walled garden approach that’s certainly taken a big chunk of malware threats out of their devices but their walled garden approach is ridiculous and impractical for Linux. The Microsoft method of monitoring and second guessing everything with antimalware programs is also suspect because it is super easy to abuse and resource intensive. We have clamAV but clam kinda sucks.
Linux is at the point where we need something that audits what’s going in and automatically yanks it back out remotely if it’s found to be a problem. Things can only be added by the user, but the bot can remove them without interaction of the user.
I don’t see this happening though. Instead, I see this as more of a rust vs C thing all over again, where valid critiques are drowned out by “improve your skills bro.”
Gotta assume that if any Arch users actually fell for that one, that they either let their kids use their device or they're generally not smart ( which absolutely goes against my stereotypical view of an arch user ).
The stereotype of arch uses generally being smart is no longer. The "I use arch btw" meme brought a whole new user base to arch. You'll find them on r/unixporn showing off their hyperland rice that they copied from some other user..
I had no idea that existed but I’ve just returned from r/unixporn. There are some sick setups. Also we all copy. My entire neovim config is copied and modified from a couple dozen setups I admired. Nothing wrong with copying things you like. Don’t gate keep Linux.
the firefox, zen browser and libre wolf packages are concerning. The ttf ms font too. Those are very normal apps and unless you pay attention to the package name when doing "pacman -Syu", you would fall for the malware.
If only we can compartmentalize all AUR packages. The download AUR sources iirc are already in something like $HOME/.paru. Installing is a different story, because these packages can put their executable all over the places: /usr/local/bin, $HOME/local/bin.
With respect, you wouldn't install these by just doing an update, so pacman -Syu is fine.
You would have needed to install these manually, or a package that depended on them - both from AUR - so you'd also need to use yay (etc) to install them.
But - I totally agree with your points that tge names look innocent enough for someone to install those over other packages.
Always look at the AUR (website) at the package details - if it's new(ish) and has 0 or 1 votes, then be suspicious.
From August 15-17 2025, SWF will be helping to bring the Fediverse to HOPE. HOPE (Hackers on Planet Earth) is a grass-roots conference for hackers and developers in Queens in New York City. This year, I (Evan) will be speaking at the event on Aug 15 at 2P
From August 15-17 2025, SWF will be helping to bring the Fediverse to HOPE. HOPE (Hackers on Planet Earth) is a grass-roots conference for hackers and developers in Queens in New York City. This year, I (Evan) will be speaking at the event on Aug 15 at 2PM ET, and we (SWF) will be organizing a Fediverse Village for HOPE_16.
Villages are available themed spaces in the St. John’s University campus to be used for coordinating activities. We’re hoping (!) to have talks, meetings, hacking events, and social gatherings at the Fediverse Village.
If you are involved in the Fediverse – or want to be – please join us at HOPE. There will be a lot of interesting and exciting things happening. And if you have good ideas for things to do at the Fediverse Village, please comment or let me know at @evanprodromou@socialwebfoundation.org.
HOPE_16 is an all-ages event with at least four speaker tracks, a whole bunch of workshops, awesome vendors, and fun activities throughout the entire weekend.
Dal 19 luglio al 30 agosto torna a Trevi la magia della rassegna “Sotto il cielo di Trevi – Musica e teatro nel paesaggio”, promossa dal Teatro Belli di Antonio Salines con il patrocinio del Comune. Un cartellone che trasforma borghi, piazze e parchi in palcoscenici a cielo aperto, con spettacoli, emozioni e incontri.
Villa Fabri, la Chiesa di San Lorenzo, il Parco Agricolo, Piazza Mazzini, Matigge e Cannaiola ospiteranno artisti e compagnie in serate dedicate alla cultura, alla riflessione e al divertimento.
Ad aprire la rassegna, il 19 luglio, “L’impresario delle Smirne” di Goldoni con Gigi Savoia, per poi proseguire il 20 luglio a Matigge con “Contaminazioni poetiche” tra poesie e canzoni popolari. Il 26 luglio, Edoardo Siravo interpreta Achab in “Moby Dick”, mentre il 28 luglio va in scena “I Menecmi” di Plauto.
Il 1° agosto, “Voci di donne – Lettere a Mascagni” esplora il ruolo femminile nelle opere del compositore; il 3 agosto, tra musica e gastronomia, “Rossini e i sapori della musica”. Il 4 agosto omaggio a Pasolini con “Tutto il mio folle amore lo soffia il cielo”; il 5 agosto “Per futili motivi”, satira distopica su una società fondata sull’odio.
Il 22 agosto il “Sognatore” di Dostoevskij prende vita al Parco Agricolo; il 23, visita teatrale itinerante gratuita “Trevi, ovvero vissi d’amore e di merangole”. Il 24, alla Chiesa di San Francesco, “Domenico, un uomo buono”, su San Domenico da Foligno.
Il 29 agosto, concerto spettacolo dei Baraonna in Piazza Mazzini. Chiusura il 30 agosto a Cannaiola con “Canzoni sulla Luna” del gruppo The Eldar.
Biglietti: €10 a Villa Fabri, €3 altrove. Info: 327 818 4788 – compagnia@teatrobelli.it – Prevendite su VivaTicket.
“Sotto il cielo di Trevi“ accende l’estate di teatro e musica Dal 19 luglio al 30 agosto 2025 torna la magia della stagione estiva firmata Teatro Belli di Antonio Salines con spettacoli, emozioni e incontri tra le vie, i parchi...
Da venerdì 25 a domenica 27 luglio, il centro storico di Pergola, uno dei Borghi più Belli d’Italia, ospita la 53esima edizione della Festa del Vino, organizzata dalla Pro loco con il patrocinio del Comune. Un’edizione speciale che celebra i 20 anni del Pergola Doc, eccellenza locale sempre più apprezzata.
Tre giorni di iniziative dedicate all’“Oro Rosso” pergolese, tra degustazioni, riflessioni e festa. Venerdì alle 19.30, sotto i portici di Piazza Garibaldi, l’evento “A cena con Aleatico & Lacrima”: degustazione guidata di 9 vini (tra Pergola Doc, Uva Nera Rada e Lacrima di Morro d’Alba DOC), condotta dal sommelier Raffaele Papi, vicepresidente AIS Marche, con racconti e curiosità dei produttori. In abbinamento, menù speciale dello chef Filippo Petrolati. Prenotazione obbligatoria (tel. 388.0732931).
Sabato alle 17.30 in sala consiliare si terrà la tavola rotonda “20 anni di Pergola Doc”, con produttori ed esperti come Alberto Mazzoni (IMT), Luca Gambucci (AIS Marche Fabriano) e il produttore Stefano Tonelli, per ripercorrere la storia e il valore culturale del Pergola Doc. Modera Ubaldo Alimenti. A seguire degustazione sotto i portici.
Nel weekend, le cantine del centro storico proporranno degustazioni di Pergola Doc e specialità tipiche, accompagnate da musica, animazione, laboratori, arte, area bimbi e tanta ospitalità.
Festa del Vino, a Pergola si celebrano i 20 anni del Pergola Doc Dal 25 al 27 luglio 2025: 3 giornate ricche di iniziative Un viaggio sensoriale tra tradizione, gusto e convivialità decollerà venerdì 25 luglio, quando a Pergola si...
The Astronomer CEO's Coldplay Concert Fiasco Is Emblematic of Our Social Media Surveillance Dystopia
Subscribe
Join the newsletter to get the latest updates.
Success
Great! Check your inbox and click the link.
Error
Please enter a valid email address.
The CEO seemingly having an affair with the head of HR at his company at the Coldplay concert is a viral video for the ages, but it is also, unfortunately, emblematic of our current private surveillance and social media hellscape.
The video, which is now viral on every platform that we can possibly think of, has been covered by variousnews outlets, and is Pop Crave official, shows Andy Byron, the CEO of a company called Astronomer, with his arms around Astronomer’s head of HR, Kristen Cabot. The jumbotron cuts from one fan to this seemingly happy couple. They both simultaneously die inside; “Oh look at this happy couple,” Coldplay lead singer Chris Martin says. The woman covers her face and spins away. The man ducks out of frame. “Either they’re having an affair or they’re very shy,” Martin said. The camera pans to another company executive standing next to them, who is seemingly shaking out of discomfort.
It is hard to describe how viral this is at the moment, in a world in which so many awful things are occurring and in which nothing holds anyone’s attention for any length of time and in a world in which we are all living in our own siloed realities. “Andy Byron” is currently the most popular trending Google term in the United States, with more than double the searches of the next closest term.
There are so many levels to this embarrassment—the Coldplay of it all, the HR violation occurring on jumbotron, etc—that one could likely write a doctoral dissertation on this 15 second video.
0:00 /0:19 1×
This post is for subscribers only
Become a member to get access to all content Subscribe now
Facial recognition and crowdsourced social media investigations are constantly being used not just on cringe CEOs, but on random people who are simply existing in public.
According to the filing, Lipnik has been fired from Apple “for failing to follow Apple’s policies designed to protect its confidential information, including development devices and unreleased software and features.” The filing also accuses Lipnik of failing to report “multiple prior breaches” to Apple.
When you sign an NDA (non-disclosure agreement), you’d best protect the secrets. Then again, the guy who left an iPhone 4 in a bar didn’t lose his job. Wonder what the differences are between them.
Valso
in reply to CannonGoBoom • • •kurumin
in reply to Valso • • •