Here is how I did it :

Get a list of installed packages originating from AUR using 'yay' :

  yay -Qam > packages_aur.last

Get list from https://md.archlinux.org/s/SxbqukK6IA# :

  curl https://md.archlinux.org/s/SxbqukK6IA/download > compromised.txt

then :

  grep -wFf compromised.txt packages_aur.last

should spit out the packages that are in both files, hence were compromised at some point, I guess.

Thank you for this! I only had two on my system, thank goodness. I have uninstalled both.

libgdata 0.18.1-5 qt5-3d 5.15.18-1

Have you checked the install date? I'm not sure which are the compromised version numbers, but if they were installed before June 10 you're probably safe. (I think libgdata 0.18.1-5 used to be on the main repos in February, and has recently been downgraded to AUR, so you may be fine).

Only packages from AUR have been compromised, meaning a normal update `pacman -Syu` won't install them, they'll only be installed by `makepkg` or AUR helpers (such as `paru`, which asks you to review the PKGBUILD diff).

Also, if you had installed a compromised version, uninstalling the packages is not enough, you'd probably need to reinstall your system and rotate all credentials. More info here and on the linked blog: https://discourse.ifin.network/t/400-aur-packages-compromise...

These were installed before June 10th I am almost certain. I will read that link just to be safe!

Looking at my pacman cache both of these versions existed on my system before June of this year so I think I am okay.

Does this mean that each software you run is now the size of a windows install + sw or is it a single container that runs all your softwares ?

For now single container runs all softwares. tradeoff with dockur/windows limits, saves ram and disk. planning multi container later for better isolation.

Well yes, finally, optimizing instead of throwing silicon, water and electricity at it until it works. Thats the way.

"lleu.site" might not be the clearest in regards to what the service offers. It reads too nerd. Something like "easyweb.site" or "yourown.site" might better describe it.

Thanks. I am definitely injecting too much nerd. I just couldn't help myself. I do have alternate urls available but point taken. I should probably redo the branding.

Spot on :

> Someone once said that “AI feels amazing when it’s talking about a subject you know nothing about, but is laughably wrong when you do”.

> Someone else also said “I want AI to do my laundry so I can make Art, not make my Art so I can do laundry”.

I know articles from Derek Lowe's series pop up on here every now and then. Here is a RSS feed you can pu in your RSS reader, and have all 33 articles available to (re) read. Enjoy !

(Alternatively, you can find all these articles in HTML here : https://www.science.org/topic/blog-category/things-i-wont-wo...)

Well of course a DSLR will be better than a phone camera for most things, since you can control more features. That's also the point of OpenCamera; get as much controls as you can back, compared to the stock app that might be lacking. It wont do miracles if your phone camera is not good to begin with.

I've found OpenCam to be useful because of the various optional features ( onionskin, levelmeter, locking settings ). You can also set the bitrate/size/duration of videos, etc. Lots of useful stuff.

Took me far too long to realize this is 13 yo.

Looks like the service is still up.

EDIT: They also offer a service to ssh into various vintage systems, which is cool : https://sdf.org/?ssh

That's what reverse-centaurs are for; being an accountability sink.

https://pluralistic.net/2025/09/11/vulgar-thatcherism/

And yet, the project is hosted on MS github... So much for sovereignty :facepalm

So what happens to the 500,000+ users when Trump tells MS to nuke the repo/infra ?

that isn't much of a problem - git repositories can be re-hosted somewhere else. carrying the bug tracker over is another issue entirely.

Well I still think it's something to worry about before you end in front of a "Your account has been suspended" notice. How can you be sure someone has the whole dataset locally backed up ? Plus, you still have to reconfigure the workflows and stuff like that. Not to mention that sometime, project's websites are also hosted on github, so that's something else you have to rebuild.

And also, this means devs/contributors have to give their data to MS.

Since the whole point of the project is sovereignty, it should have started with setting up their own gitea/gitlab/etc. instances and domains.