PackageManagement
Post #6133 · source on Telegram
Trust me bro, this random AUR Firefox build is totally safe and secure
Description
The meme shows the Arch Linux logo centred on a light-grey background. Beneath it, white monospaced text on a dark background reads: “R: 124 / I: 10 >here is your firefox package bro, compiled by our fellow ‘superhacker2004china’. It’s totally safe and secure, bro, you’re free to log into your bank account with it.” The joke plays on Arch Linux’s AUR culture where end-users install binary packages compiled by strangers, highlighting the software-supply-chain risk of trusting unsigned third-party builds for sensitive tasks like online banking. Senior engineers will recognise concerns around package provenance, dependency trust, and open-source security hygiene
More like this
More like this in PackageManagement →
Use J and K for navigation
Comments
32Comment deleted
Our SBOM meeting: “Every dependency must be reproducible, signed, and SLSA-level 3.” Our laptop an hour later: `yay -S firefox-superhacker2004china-bin --noconfirm`
Nothing says 'I've achieved enlightenment' quite like trusting superhacker2004china's Firefox build with your banking credentials - it's the Arch way of natural selection in production environments
Ah yes, the classic Arch Linux experience: spending 3 hours meticulously configuring your system for maximum security and minimal bloat, only to casually install a browser binary compiled by 'superhacker2004china' from the AUR because the official repo version is 0.2 versions behind. Nothing says 'I value my privacy' quite like running a web browser built by someone whose username reads like a honeypot's idea of a subtle alias. But hey, at least you can tell everyone you use Arch - right before explaining to your bank why there are unauthorized transactions from Shenzhen
Arch AUR: where supply-chain security is skimming a PKGBUILD, trusting a random GPG key, and calling it SLSA Level “bro” - then using your bank login as the integration test
AUR: Where PKGBUILDs from superhacker2004china turn 'bleeding edge' into 'bled dry'
Zero‑trust at the org chart, full‑trust in AUR: clone a stranger’s PKGBUILD, build a browser, then verify it by logging into your bank
firefox is official package and not distributed via aur but, if you have doubts about security of package, just look at build script Comment deleted
but yes, aur is not recommended and can be dangerous Comment deleted
> you can always compile it yourself > -bin ????? Comment deleted
sorry, i fucked up Comment deleted
🔣 HHDoeuwFR_geasAbGnovnuwatDn_n8nw3o7q?== Comment deleted
what Comment deleted
Only visible in iOS Comment deleted
ok Comment deleted
Here is your iOS operating system. Totally safe. Comment deleted
Lets hope its not gonna rce Comment deleted
>here is your google chrome .exe file compiled by google, It's totally safe and secure and surely not spying on everything you do! source: trust me Comment deleted
BTW I've heard Microsoft actually released Rewind as enabled by default. Is that true? Comment deleted
They were going to do that, but after the backlash they said it's going to be opt in by default, but it's Michaelsoft they will enable it "accidentally" in a windows update☠️ Comment deleted
Here is your visual-studio-code-bin Comment deleted
Try to update Comment deleted
Is it already fixed? Comment deleted
Possibly, because I don’t see it:) Comment deleted
It is damn Comment deleted
In fact, this actually might be quite safe. But you never know. Comment deleted
I agree Comment deleted
Yeah if you use incognito superhacker2004china can't decrypt ssl💯 Comment deleted
I doubt someone named superhacker2004china knows how to save a file onto the desktop using the save file dialog💀😂 Comment deleted
even the firefox and google itself can't! Comment deleted
Both of them can they own some root level ssl certificates and also some intermediate one Comment deleted
bruh, im just make irony Comment deleted
Replace you root certificates with BurpSuit 😂 Comment deleted