January 2024 - Aur-requests - lists.archlinux.org

[PRQ#52588] Deletion Request for youtube
by notify＠aur.archlinux.org 26 Feb '24

26 Feb '24

xiota [1] filed a deletion request for youtube [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/youtube/

1 1

[PRQ#52587] Deletion Request for twitter
by notify＠aur.archlinux.org 26 Feb '24

26 Feb '24

xiota [1] filed a deletion request for twitter [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/twitter/

1 1

[PRQ#52582] Deletion Request for snapchat
by notify＠aur.archlinux.org 26 Feb '24

26 Feb '24

xiota [1] filed a deletion request for snapchat [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/snapchat/

1 1

[PRQ#48891] Deletion Request for steve++
by notify＠aur.archlinux.org 26 Feb '24

26 Feb '24

a821 [1] filed a deletion request for steve++ [2]: A joke PKGBUILD that does nothing [1] https://aur.archlinux.org/account/a821/ [2] https://aur.archlinux.org/pkgbase/steve++/

1 1

[PRQ#48773] Deletion Request for bash-xdg
by notify＠aur.archlinux.org 26 Feb '24

26 Feb '24

MarsSeed [1] filed a deletion request for bash-xdg [2]: Outdated duplicate of core/bash, with minimal modification. XDG specification support is a fundamental goal of Arch Linux. If a repo package could be enhanced to better respect that spec, one should file an upstream issue and/or an Arch Linux bug with a suggested patch, instead of recreating Arch repo builds on AUR. [1] https://aur.archlinux.org/account/MarsSeed/ [2] https://aur.archlinux.org/pkgbase/bash-xdg/

1 1

[PRQ#48751] Deletion Request for waybar-hyprland-cava-git
by notify＠aur.archlinux.org 26 Feb '24

26 Feb '24

MarsSeed [1] filed a deletion request for waybar-hyprland-cava-git [2]: This package is now defunct. TLDR; Waybar now fully supports Hyprland workspaces and persistent workspaces. Also the patch used in this package is no longer valid or workable. Details: Since waybar 0.9.20+ release, upstream no longer invokes the hyprctl CLI to manipulate and query Hyprland workspaces. The patch is based on invoking hyprctl. Also @zjeffer, one of the contributing developers of Waybar replied on 2023-09-07 to my remark above that I submitted as a comment on the AUR/waybar-hyprland-git page [a]: " I can confirm that this package is no longer necessary, for the reasons @MarsSeed listed, and also the fact that wlr/workspaces does not work anymore with Hyprland, since this Hyprland commit: https://github.com/hyprwm/Hyprland/commit/bb09334 " The patch used in 'waybar-hyprland-cava-git' modifies Waybar's wlr/workspaces manager, which is defunct for Hyprland. Users and maintainer have been notified by me in the beginning of September 2023. [a]: https://archive.li/eoEyI#comment-932841 [1] https://aur.archlinux.org/account/MarsSeed/ [2] https://aur.archlinux.org/pkgbase/waybar-hyprland-cava-git/

1 1

[PRQ#48774] Deletion Request for gmrun-xdg
by notify＠aur.archlinux.org 26 Feb '24

26 Feb '24

MarsSeed [1] filed a deletion request for gmrun-xdg [2]: Outdated duplicate from 2015 of extra repo's much newer gmrun. [1] https://aur.archlinux.org/account/MarsSeed/ [2] https://aur.archlinux.org/pkgbase/gmrun-xdg/

1 1

[PRQ#48872] Deletion Request for xvidcap
by notify＠aur.archlinux.org 26 Feb '24

26 Feb '24

MarsSeed [1] filed a deletion request for xvidcap [2]: Broken, unused, unbuildable application from 2015. [1] https://aur.archlinux.org/account/MarsSeed/ [2] https://aur.archlinux.org/pkgbase/xvidcap/

1 1

[PRQ#48766] Deletion Request for xiaomi-adb-fastboot-tools-bin
by notify＠aur.archlinux.org 26 Feb '24

26 Feb '24

mh4ckwascut [1] filed a deletion request for xiaomi-adb-fastboot- tools-bin [2]: The upstream repo have been deleted, package not installable anymore. https://github.com/Szaki/XiaomiADBFastbootTools [1] https://aur.archlinux.org/account/mh4ckwascut/ [2] https://aur.archlinux.org/pkgbase/xiaomi-adb-fastboot-tools-bin/

1 1

[PRQ#48767] Deletion Request for xiaomi-adb-fastboot-tools
by notify＠aur.archlinux.org 26 Feb '24

26 Feb '24

mh4ckwascut [1] filed a deletion request for xiaomi-adb-fastboot-tools [2]: The upstream repo have been deleted, package not installable anymore. https://github.com/Szaki/XiaomiADBFastbootTools [1] https://aur.archlinux.org/account/mh4ckwascut/ [2] https://aur.archlinux.org/pkgbase/xiaomi-adb-fastboot-tools/

1 1