starshipwinepineapple @ starshipwinepineapple @programming.dev

Posts

2

Comments

171

Joined

2 yr. ago

I would say the bigger issue is needing more people willing to be package maintainers. Their docs do cover how to move packages from AUR to an official package but it does involve needing to be sponsored by existing package maintainers and doing extra work. In the end it didn't seem worth it for my package that meets the criteria to be /extra.

And with the AUR malware issue, if these AUR maintainers can't be bothered to maintain their packages and let them get orphaned, then how would you expect those maintainers to meet that higher standard of work?

Like any open source project, the limiting factor is the volunteers. And, well, I'm just not going to tell the arch linux volunteer package maintainers they need to do more when I haven't been willing to do the work they are doing

Right, and I'm saying that a lot of updates are mundane and easy for anyone to read. And if they aren't mundane then look into it. Try to learn. The alternative is to run code you don't understand and hope for the best which didn't work out for people here. So if you don't want to try to learn, and you don't want to blind trust, then the alternative is to not use the AUR.

Like one of the attack vectors was adding a "post install" step that was a bunch of obsfucated gibberish which should've been a red flag for anyone, technical acumen or not

Then learn to read the diffs. Most of the time they are changing the version number and package hash which is mundane and nothing to worry about. If more than that changed then that should make you curious why and dig deeper.

So you remember how your helper asks you to see diffs ... you take a look at those and understand them before approving, right?

Because I'm getting the sense that people are not doing that

Here are some scripts that can help too

(Edit: apparently i need to say to read and understand what these scripts are doing before running them. If you don't understand what you're running then don't run them) https://gist.github.com/Kidev/85756c3dcad3623ca5604a8135bafd14

You probably arent going to use synology photos long term anyway, unless you plan on buying synology products forever even when they go back and forth on anti conumer things (requiring synology harddrives).

I use immich on my synology NAS and i am happy with it. I did not migrate from synology photos though so I'm not sure how you'll be able to retain your tags and such. If it was me id set up immich going forward and then work on migrating old data

Might be your instance. Try blog and spot and .com without spaces. The blog is also linked within OPs article

Their april 15th blog post explicitly calls it a backdoor and mentions it was very well hidden. I'm interested to see what comes of this

Article really buries the lede here by not even mentioning mitigation for all 3 vulnerabilities:

Update UniFi Network application to Version 10.1.89 or later.

In your docker-compose.yaml you need to add in your directory if you haven't already

 diff

    
services:
  immich-server:
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
+     # Add NAS pictures and videos folders to use as External Libraries
+     - "/volume1/data/ Pictures:/usr/src/app/library/pictures"

  

Then in immich you need to add this as an external library. Click your profile icon -> administration -> external library -> create library. It will ask for a path and you need to use the library mount point within docker which was /usr/src/app/library/pictures from my example. Click add path

That should get you good to go

Your github has no source code or licensing. Not sure if that was intentional or not since i see your github acct is only a few days old

Hadn't heard of explo before. Neat

Keep that n8n updated. Theres been several high and critical severity CVE's recently and I'm betting more to come

I see you're new to lemmy so maybe you missed reading the comments from the last time you asked this question https://programming.dev/post/48344373

(I can't see the edited out part but if it was about yay...)

Yay builds in your local cache and then when it is ready to install it asks for sudo. The reason for this is because sudo can timeout during long builds, and more importantly if you compile with sudo you run the risk of arbitrary code execution. So it is safer to run with just yay and then it will ask for sudo when it actually needed.

what you use for your documentation

Hugo (markdown) files that i host on my internal server.

how you organize it

I use basic directory structure. Top level directories are like "dev", "home", "general". Self hosting is a dev/ subdir.

what information you include

Depends on how familiar i am with it and how often I'll be referencing it. Something i know well or access often will be more high level. Things like an annual process i have documented in more detail

how you work documentation into your changes/tinkering flow

My site has an "edit this page" feature which i use to open my IDE and make the change as I'm doing things. Sometimes I'll be lazy and just add in what i did this time and then let future me reconcile the differences 🙃

Codeberg has limited private repos though which i assume is what they were referring to.

Sourcehut allows private repos. Alternatively id look into a self hosted forgejo instance you control.

And many people overlook it but git has its own webui.

To be fair MS makes orders of magnitude more money and has the benefit of operations at scale. Whereas codeberg's operational budget for 2025 was 100k euro and they still need to deal with DDoS and bot scraping. They also were running off a single server up until sept'25 when they had two donated hardware services which are now hooked up to make a 3 node ceph cluster.

If I'm being completely honest, it sounds like you hit a problem and then just kinda gave up (I'm not trying to sound mean or anything - please don't take it that way).

I got the same impression. Which is fine if that's someone's approach, but that same person probably shouldn't be on an arch-based distro if that's the case.