(and please, absolutely don't run above as root. Just don't.)
I carefully answered to retain any root owned files and my backups, despite knowing the backdoor wasn't included in the culprit package. This system has now "un-trusted" status, meaning I'll clean re-install the OS, once the full analysis of the backdoor payload is available.
Edit: I also booted the "untrusted" system without physical access to the web, no gui, and installed the fixed package transferred to it locally. (that system is also going to be dd if=/dev/zero'd)
Incorrect: the backdoored version was originally discovered by a Debian sid user on their system, and it presumably worked. On arch it's questionable since they don't link sshd with liblzma (although some say some kind of a cross-contamination may be possible via a patch used to support some systemd thingy, and systemd uses liblzma). Also, probably the rolling opensuse, and mb Ubuntu. Also nixos-unstalbe, but it doesn't pass the argv[0] requirements and also doesn't link liblzma. Also, fedora.
Yes, but Arch, though it had the compromised package, it appears the package didn't actually compromise Arch because of how both Arch and the attack were set up.
In my experience they're the same from a reliability standpoint. Stuff on Arch will break for no reason after an update. Stuff on Debian will break for no reason after an update. It's just as difficult to solve reliability problems on both.
Because Debian isn't a rolling release you will often run into issues where a bug got fixed in a future version of whatever program it is but not the one that's available in the repository. Try using yt-dlp on any stable Debian installation and it won't work for example.
Arch isn't without its issues. Half of the good stuff is on the AUR, and fuck the AUR. Stuff only installs without issues half the time. Good luck installing stuff that needs like 13+ other AUR packages as dependencies because non of that shit can be installed automatically. On other distros,all that stuff can be installed automatically and easily with a single command.
You can get yay for an AUR package manager, but it's generally not recommended because it means blindly trusting the build scripts for community packages that have no real oversight. You're typically advised to check the build script for every AUR package you install.
I heard this so many times that I really believed arch was so brittle that my system would become unbootable if I went on vacation. Turns out updating it after 6 months went perfectly fine.
I updated arch after two months and it broke completely, i guess it's because i had unfathomable amount of packages and dependencies, so it varies from person to person, if you keep your system light then it may work like it worked for you, if you install giant amount of packages and dependencies then it would work like it worked for me
Stuff on Debian will break for no reason after an update
I have never had this happen on Debian servers and I've been using it for around 20 years. The only time I broke a Debian system was my fault - I tried to upgrade an old server from Debian 10 to 12. It's only supported to upgrade one version at a time. Had to restore from backup and upgrade to Debian 11 first, then to 12.
I've had the exact opposite experience. I switched to Arch when proton came out, and I haven't had a system breakage since that wasn't directly caused by my actions.
Debian upgrades would basically fail to boot about 20% of the time before that.
i think it’s a matter of perspective. if i’m deploying some containers or servers on a system that has well defined dependencies then i think Debian wins in a stability argument.
for me, i’m installing a bunch of experimental or bleeding edge stuff that is hard to manage in even a non LTS Debian system. i don’t need my CUDA drivers to be battle tested, and i don’t want to add a bunch of sketchy links to APT because i want to install a nightly version of neovim with my package manager. Arch makes that stuff simple, reliable, and stable, at least in comparison.
"Stable" doesn't mean "doesn't crash", it means "low frequency of changes". Debian only makes changing updates every few years, and you can wait a few more years before even taking those changes without losing security support while Arch makes changing updates pretty much every time a package you have installed does.
In no way is Arch more stable than Debian (other than maybe Debian Unstable/Sid, but even then it's likely a bit of a wash)
It literally does though. Stable doesn't mean bug free. It means unchanging. That's what the term "stable distro" actually means. That the software isn't being updated except for security patches. When people say stable distro, that is what they are trying to communicate. That means the software will be old. That's what stable actually means.
Just Arch users being delusional. Every recent thread that had Arch mentioned in the comments has some variation of "Arch is the most stable distro" or "Stable distros have more issues than Arch".
Not gonna lie, this whole debacle made want to switch to NixOS.
Immediately rolling back to an uncompromised version was my first thought.
That and the fact that each application is isolated from each other right? Should hopefully help in cases like this
It's definitely common, but zstd is gaining on it since in a lot of cases it can produce similarly-sized compressed files but it's quicker to decompress them. There's still some cases where xz is better than zstd, but not very many.
In the case of Arch the backdoor also wasn't inserted into liblzma at all, because at build time there was a check to see if it's being built on a deb or rpm based system, and only inserts it in those two cases.
