Latest Comments by Turkeysteaks
The Arch Linux AUR had over 400 packages compromised with malware
13 Jun 2026 at 4:56 pm UTC Likes: 1
13 Jun 2026 at 4:56 pm UTC Likes: 1
Quoting: pbOr just:Lol I thought I was being so clever - that's much cleaner, thank you! I didn't know grep could do multiple files at once without combining them in some way. Appreciate it
grep atomic ~/AUR/*/PKGBUILD
for yay users:grep atomic ~/.cache/yay/*/PKGBUILD:-)
The Arch Linux AUR had over 400 packages compromised with malware
12 Jun 2026 at 7:40 pm UTC
12 Jun 2026 at 7:40 pm UTC
for anyone who doesn't use an AUR helper, I made this basic little bash script:
if you don't keep your AUR packages in ~/AUR/, you will need to change that in the code.
run it with `./<script-name>.sh <bad-package>`. so for this one, if you do `./script.sh atomic` and any of them print anything, you have been compromised. If none of them do, you're hopefully safe.
I'm sure you could probably do this more elegantly and if your AUR helper stores its packages predictably, you could also use it for that - but this is what I just made (and luckily none of mine are affected as far as I can tell) and it works for me.
It is worrying, and I'm torn - I find the AUR incredibly helpful, as it means that the only packaging system I have on my PC is pacman. AUR has filled every gap I've ever needed, compared to when I ran Ubuntu and had flatpak, apt, snap, manual `.deb` packages, and full git repos to compile from source. However clearly it is a flawed system, and this is a huge disgrace - I sincerely doubt the majority of users read through PKGBUILDs, so undoubtedly this is going to have some severe impacts. I'm also a little disappointed in the response, as I feel like there are systems they could have put in place to handle this quicker - like turning off all adoptions, for starters. Easier said than done though I'm sure.
for dir in ~/AUR/*/
do
dir=${dir%*/}
echo "${dir}"
cd ${dir}
cat PKGBUILD | grep $1
cd ~/AUR/
doneif you don't keep your AUR packages in ~/AUR/, you will need to change that in the code.
run it with `./<script-name>.sh <bad-package>`. so for this one, if you do `./script.sh atomic` and any of them print anything, you have been compromised. If none of them do, you're hopefully safe.
I'm sure you could probably do this more elegantly and if your AUR helper stores its packages predictably, you could also use it for that - but this is what I just made (and luckily none of mine are affected as far as I can tell) and it works for me.
It is worrying, and I'm torn - I find the AUR incredibly helpful, as it means that the only packaging system I have on my PC is pacman. AUR has filled every gap I've ever needed, compared to when I ran Ubuntu and had flatpak, apt, snap, manual `.deb` packages, and full git repos to compile from source. However clearly it is a flawed system, and this is a huge disgrace - I sincerely doubt the majority of users read through PKGBUILDs, so undoubtedly this is going to have some severe impacts. I'm also a little disappointed in the response, as I feel like there are systems they could have put in place to handle this quicker - like turning off all adoptions, for starters. Easier said than done though I'm sure.
Latest Steam update brings Steam Controller firmware updates and bug fixes
2 Jun 2026 at 6:32 pm UTC
2 Jun 2026 at 6:32 pm UTC
Bit disappointed there's no progress on the awful haptic/rumble issues - it just goes off like a heartbeat NON STOP on certain games. Trying to play NFS 2015 and it's making my hands numb. Heard many people reporting similar issues with 007 Last Light, Death Stranding 2, and FH6 - though I'm sure it's happening a lot with older games too but just less reported on so far.
My GF managed to snag two of these while I was cooking and stressing I wouldn't be done in time for the launch lol. Bought on the day of launch, and I think they arrived about two weeks ago (UK here also)
My GF managed to snag two of these while I was cooking and stressing I wouldn't be done in time for the launch lol. Bought on the day of launch, and I think they arrived about two weeks ago (UK here also)
X.Org Security Advisory released for 9 new vulnerabilities in X.Org X server and Xwayland
2 Jun 2026 at 6:29 pm UTC Likes: 6
2 Jun 2026 at 6:29 pm UTC Likes: 6
I think it's important to note that a bug/security hole being attributed TrendAI Zero Day Initiative is not necessarily found because of AI. It is an initiative that has been going for much longer than AI has been around (The company rebranded from Trend to TrendAI though).
It is a system that allows people to essentially get paid for finding security flaws; it is a bug bounty program. I'm sure several ARE found with AI or the help of AI tools (as TrendAI themselves do a huge amount of cybersecurity, some of which is with AI). But the bugs attributed to TrendAI may not even be from the company themselves - my understanding is essentially anyone can submit a found bug through this program.
Because it pays the contributers, a much larger percentage of the bugs are going to be 'found' through TrendAI - if you find a bug, are you going to tell the organisation directly, or go through a method where you'll be rewarded for it?
The initiative also works as a source of truth and trust for the organisations that use it - they're not going to be spammed with slop PRs for bugs that are already known, for example.
Clearly AI is having a big impact on this however, as it feels like every single week a new vulnerability is found these days.
Just something I wanted to share and feel important to mention!
The crux of this being that TrendAI aren't the only ones contributing to the TrendAI Zero Day Initiative.
It is a system that allows people to essentially get paid for finding security flaws; it is a bug bounty program. I'm sure several ARE found with AI or the help of AI tools (as TrendAI themselves do a huge amount of cybersecurity, some of which is with AI). But the bugs attributed to TrendAI may not even be from the company themselves - my understanding is essentially anyone can submit a found bug through this program.
Because it pays the contributers, a much larger percentage of the bugs are going to be 'found' through TrendAI - if you find a bug, are you going to tell the organisation directly, or go through a method where you'll be rewarded for it?
The initiative also works as a source of truth and trust for the organisations that use it - they're not going to be spammed with slop PRs for bugs that are already known, for example.
Clearly AI is having a big impact on this however, as it feels like every single week a new vulnerability is found these days.
Just something I wanted to share and feel important to mention!
The crux of this being that TrendAI aren't the only ones contributing to the TrendAI Zero Day Initiative.
Proton Experimental gets fixes for Forza Horizon 4, 5 and 6 plus other games
21 May 2026 at 10:38 am UTC
21 May 2026 at 10:38 am UTC
I'm still upset I can't buy FH4 anymore. I didn't fancy it at the time as I wasn't into racing games aside from burnout and GT4 back then, and now it's unavailable unless you pay literally £110 from a grey market key reseller.
I just want a racing game set in the UK man :( FH5 will be going soon too I'm sure, though at least they do tend to do steep discounts on most of the games before delisting.
I even have a console, but sadly it's blue not green and FH4 was exclusive to Xbox. sad
I just want a racing game set in the UK man :( FH5 will be going soon too I'm sure, though at least they do tend to do steep discounts on most of the games before delisting.
I even have a console, but sadly it's blue not green and FH4 was exclusive to Xbox. sad
X.Org X server and Xwayland security advisory released for multiple issues
15 Apr 2026 at 9:56 am UTC Likes: 2
15 Apr 2026 at 9:56 am UTC Likes: 2
Not sure what the 'TrendAI' part of the Zero Day Initiative is, but nice to see that the ZDI seems to be helping.
On the AI side though I am curious. I despise AI, and a new reason to hate it is that some of the latest models (namely Anthropic's Mythos) is *reportedly* incredibly good at finding and exploiting vulnerabilities. I take that with a huge pinch of salt because clearly it's somewhat marketing, but it does worry me. If it ever gets into the wrong hands (and to be clear, I don't really consider Anthropic to be the RIGHT hands...) and it is even half as powerful as they are claiming, it really could be dangerous - I feel even more so for Open Source projects.
Hopefully not though.
I'm a SWE, and while I still avoid AI in my workplace for the most part, my colleagues are not the same - but even the most enthusiastic are starting to feel quite sour about it. Even on the most personal and maybe selfish level, it makes the job... really damn boring. I don't want to be a 'manager', I want to code! (which again, is partly why I refuse to use AI wherever I can)
On the AI side though I am curious. I despise AI, and a new reason to hate it is that some of the latest models (namely Anthropic's Mythos) is *reportedly* incredibly good at finding and exploiting vulnerabilities. I take that with a huge pinch of salt because clearly it's somewhat marketing, but it does worry me. If it ever gets into the wrong hands (and to be clear, I don't really consider Anthropic to be the RIGHT hands...) and it is even half as powerful as they are claiming, it really could be dangerous - I feel even more so for Open Source projects.
Hopefully not though.
I'm a SWE, and while I still avoid AI in my workplace for the most part, my colleagues are not the same - but even the most enthusiastic are starting to feel quite sour about it. Even on the most personal and maybe selfish level, it makes the job... really damn boring. I don't want to be a 'manager', I want to code! (which again, is partly why I refuse to use AI wherever I can)
Half-Life Legacy arrives December 12 but you'll need Proton on Linux due to Native Linux issues
3 Dec 2025 at 11:54 am UTC Likes: 7
3 Dec 2025 at 11:54 am UTC Likes: 7
With all the hype, I won't lie my heart stuttered seeing "Half Life" and "arrives December 12" thanks to my selective reading.
Some day, some day...
Some day, some day...
How to get Battlefield 3 and Battlefield 4 online working on Linux, SteamOS, Steam Deck
23 Nov 2025 at 5:12 pm UTC
23 Nov 2025 at 5:12 pm UTC
Realise this is a bit old now, but I've been playing with BF4 for a year or so and one thing is really annoying - no steam overlay. Which also means no steam recorder.
Do you or anyone have any experience with getting the steam overlay to work with this?
Do you or anyone have any experience with getting the steam overlay to work with this?
Grab a free copy of Warhammer: Vermintide 2 for a limited time
21 Nov 2025 at 9:20 pm UTC Likes: 4
Nowadays I'm 90% sure it's plug and play, but someone else chime in if they know for certain
21 Nov 2025 at 9:20 pm UTC Likes: 4
Quoting: CloversheenAnyone having any experience playing it crossplay?To be clear I've not played in ages, but crossplay used to work although it was something weird like I believe the Windows user would have to host.
We would be playing it with 2 linux users and 1 windows user.
Nowadays I'm 90% sure it's plug and play, but someone else chime in if they know for certain
Bioflux - Horde is a survival game where the infected numbers look insane
21 Nov 2025 at 11:21 am UTC
21 Nov 2025 at 11:21 am UTC
This looks insane, love it