Badabinski

It probably is. I think there are newer examples available, but I lack the motivation to find them for others. I feel it still represents the fundamental issues with Manjaro, if not the current specific ones.

Any other derivatives are fine AFAIK, just not Manjaro. There’s quite a bit out there about why you should avoid Manjaro. This source is older, but I’ve linked it before: https://github.com/arindas/manjarno

Any of them that use the Arch repos directly are probably fine. Don’t use Manjaro.

I will say that Arch does now have a guided installer, so you don’t need to do everything manually. Here’s the wiki page for it: https://wiki.archlinux.org/title/Archinstall

btw I use arch

No, it’s syphilitic brain damage.

I mean, yeah. I wouldn’t have found that project and gone to the effort of using it if a simple dehu was all I needed. I wanted something I could control with my local home assistant install, and you can’t just hard power cycle a dehumidifier, it kills them.

That’s why projects like this are great: https://github.com/Hypfer/esp8266-midea-dehumidifier

My Midea Cube dehumidifier can never be bricked and will never send data outside of my home. It talks to Home Assistant via MQTT and nothing else.

Sounds like they either used a boilerplate EULA or hired a lawyer who is unaware of the requirements imposed by the GPL. If it’s the latter then I hope they can get their money back.

EDIT: yeah, this looks like an unmodified GPL to me: https://github.com/layground/pockaw/blob/master/LICENSE.md

I dunno, I’d slow your roll on that. Hanlon’s razor came to notoriety in the field of computer science for a reason. I’ve done software dev professionally for over ten years now and you wouldn’t believe the stupid shit I’ve seen people write. The only thing that sucks more than a computer is the human writing software for it.

For those unfamiliar, here’s Hanlon’s razor:

Never attribute to malice that which is adequately explained by stupidity.

EDIT: After a quick look at the CVEs, this definitely sounds like a big ol’ fuckup. It sounds like there might be some unsafe defaults in polkit as well?

EDIT: Here’s the report from the actual researchers which is MUCH more cogent than OP’s article: https://www.openwall.com/lists/oss-security/2025/06/17/4

It’s chaining two separate oopsies together. This overview on GitHub also provides more details about the libblockdev side of things: https://github.com/advisories/GHSA-mpgj-hch9-5rvx

Specifically, this section:

However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

That really doesn’t sound like something intentional to me. That sounds like a HUGE oopsy-woopsy fucky-wucky, to get technical about it.

For people like me who didn’t know what this was:

Stremio offers a secure, modern and seamless entertainment experience. With its easy-to-use interface and diverse content library, including 4K HDR support, users can enjoy their favorite movies and TV shows across all their devices. And with its commitment to security, Stremio is the ultimate choice for a worry-free, high-quality streaming experience.

edit: honestly, that’s a shitty description. This one seems a bit better:

Stremio is a modern media center that gives you the freedom to watch everything you want.

Still uses VMs, although it’s 1 VM per container.

There’s also ZZ 👉😎👉 Same caveats apply, smash that fukken esc key (for bonus points rebind caps lock as esc) then ZZ Top your way out of that shit.

I feel like bpf would be a decent solution for anticheat. I believe you can limit what an ebpf program can look at quite effectively.

Yep. Thankfully, the project is AGPL v3 licensed.

Should have just used AGPL from the start, instead of falling back to this fucked up modified BSD license. It wouldn’t stop people from stripping the branding, but they’d have to release source code which would tell all users what they’re actually using.

I knew I had heard of this game, but I couldn’t remember its premise. For anyone else like me:

THE LONG DARK is a thoughtful, exploration-survival experience that challenges solo players to think for themselves as they explore an expansive frozen wilderness in the aftermath of a geomagnetic disaster. There are no zombies – only you, the cold, and all the threats Mother Nature can muster.

For those who like me who didn’t know what this is, I believe it’s an open source reimplementation of a Bambu AMS module. I’m probably not 100% correct about that, so if OP responds then you should listen to them, not me.

These are good points. I was in a shitty mood when I made my comment and upon reflection, it’s an overstatement and not a very good take. I do still strongly support copyleft licenses and DCOs over CLAs, but I shouldn’t turn my nose up when something is released without those.

I used to be excited when companies open-sourced stuff, and that is no longer the case. I suppose I’m just frustrated and bitter and cynical when it comes to large companies doing good things.

Hence my initial whinging about how this was released with a permissive license and a copyright transfer. The longer I’m involved in this industry, the less I like permissive software licensing. There’s obviously a place for it, but my tolerance for permissive licensing is directly tied to my trust for the person or organization backing the software. I don’t trust Microsoft, and I don’t think I will ever personally contribute to their software unless my contribution is made under a copyleft license and with a DCO, not a copyright-transferring CLA.

You’re correct, but I don’t believe that a company shouldn’t be allowed to take my code and change its license in the future. If they want to take something proprietary, they can go ahead and remove my contribution from it first.

You absolutely do not need a CLA with a copyright transfer. There are plenty of large projects that use a Developer Certificate of Origin that protects the company while not allowing them to change the license of your contribution.

I’ll grant that my original post was pissy and angry and not a great take, however. You make good points here.