January 2024 - Aur-requests - lists.archlinux.org

[PRQ#49074] Deletion Request for bin32-firefox-esr52
by notify＠aur.archlinux.org 27 Feb '24

27 Feb '24

MarsSeed [1] filed a deletion request for bin32-firefox-esr52 [2]: Defunct binary package in disguise from 2020; uses a prebuilt tarball but pkgname doesn't have a -bin suffix. Not compatible with current dependency library versions. I recommend deletion. [1] https://aur.archlinux.org/account/MarsSeed/ [2] https://aur.archlinux.org/pkgbase/bin32-firefox-esr52/

1 1

[PRQ#48922] Deletion Request for thcrut
by notify＠aur.archlinux.org 27 Feb '24

27 Feb '24

a821 [1] filed a deletion request for thcrut [2]: Abandoned package. Sources are 404. [1] https://aur.archlinux.org/account/a821/ [2] https://aur.archlinux.org/pkgbase/thcrut/

1 1

[PRQ#48984] Deletion Request for django-registration-hg
by notify＠aur.archlinux.org 27 Feb '24

27 Feb '24

a821 [1] filed a deletion request for django-registration-hg [2]: Abandoned package. Out of date sine 2016. Bitbucket disables mercurial repos long ago. Missing deps. No package function. [1] https://aur.archlinux.org/account/a821/ [2] https://aur.archlinux.org/pkgbase/django-registration-hg/

1 1

[PRQ#52586] Deletion Request for twitch
by notify＠aur.archlinux.org 27 Feb '24

27 Feb '24

xiota [1] filed a deletion request for twitch [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/twitch/

2 2

[PRQ#52579] Deletion Request for paramountplus
by notify＠aur.archlinux.org 27 Feb '24

27 Feb '24

xiota [1] filed a deletion request for paramountplus [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/paramountplus/

1 1

[PRQ#52580] Deletion Request for primevideo
by notify＠aur.archlinux.org 27 Feb '24

27 Feb '24

xiota [1] filed a deletion request for primevideo [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/primevideo/

1 1

[PRQ#52581] Deletion Request for simplelogin
by notify＠aur.archlinux.org 27 Feb '24

27 Feb '24

xiota [1] filed a deletion request for simplelogin [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/simplelogin/

1 1

[PRQ#52583] Deletion Request for stan-desktop
by notify＠aur.archlinux.org 27 Feb '24

27 Feb '24

xiota [1] filed a deletion request for stan-desktop [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/stan-desktop/

1 1

[PRQ#52584] Deletion Request for tailscaledesktop
by notify＠aur.archlinux.org 27 Feb '24

27 Feb '24

xiota [1] filed a deletion request for tailscaledesktop [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/tailscaledesktop/

1 1

[PRQ#52585] Deletion Request for tubi
by notify＠aur.archlinux.org 27 Feb '24

27 Feb '24

xiota [1] filed a deletion request for tubi [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/tubi/

1 1