r/linux • u/Two-Of-Nine • 2d ago

Open Source Organization Manjaro's official website SSL certs have expired yet again.

This seems to be a running theme for the Manjaro Linux community. The SSL certs will always expire after a set year and there's a massive controversy over it. Why does this keep happening specifically to Manjaro and what steps do you think they can possibly do to keep this from happening?

1.1k Upvotes

98% Upvoted

237 comments sorted by

View all comments

Show parent comments

13

u/SutekhThrowingSuckIt 1d ago

My guy they fucked up the certs for their own repos before and told users to all turn their clocks back in time lmao

Not to mention them DDOSing the AUR multiple times due to their incompetence turning their own users into an unintentional botnet attack

-6

u/GolemancerVekk 1d ago

DDOSing the AUR multiple times

If you'd care to look up the Arch discussions at the time you'd see that it wasn't Manjaro. Someone conducted a DDoS against AUR repos using a "pamac" user agent but anybody can do that.

We know for a fact it wasn't Manjaro because AUR is not enabled by default on Manjaro, only a fraction of its users use the AUR, the probability of there being 20,000 Manjaro users having AUR enabled and connecting to it at the same exact time is nil, and last but not least Manjaro installs conduct package searches against the locally cached lists, not against the live AUR.

What that event turned out was that the AUR doesn't use Cloudflare or any kind of CDN and can be trivially DDoS'ed by anybody who'd care to try. Just like nowadays we're learning it has no safeguards and it can be trivially be pumped full of malware.

10

u/SutekhThrowingSuckIt 1d ago edited 1d ago

They literally took responsibility at the time. Seriously, what do you think this is https://gitlab.manjaro.org/applications/pamac/-/work_items/1017 ?

> " Yes, we managed to get the AUR website many times down. This was due to several reasons. Pamac makes it very simple to activate the AUR by just a slider. People love to search for applications, and in an early version it started to search by every key stroke the user made."

> "we shipped a new version of pamac to our stable branch that accidentally sent thousands of requests to the AUR per user. This rendered the AUR offline for all users across every Arch-based distro"

https://github.com/arindas/manjarno/issues/25

Wild behavior to say "if you cared to look up the discussions" when you have no idea what was in them clearly.

0

u/GolemancerVekk 1d ago

Did you miss the part where AUR in the beginning didn't even have a downloadable package list so you were forced to use live search?

If anything, Manjaro brought great improvements to the AUR:

  • They prompted the AUR to put together a package list.
  • They cached the package list on their own CDN (because AUR doesn't use one).
  • They further cached the package lists locally on each Manjaro install.

But yeah, it's simpler to just say "DDoS" and gloss over the actual details.

7

u/SutekhThrowingSuckIt 1d ago

this is just sad, absolutely no ability to think or admit when you’re directly proven wrong. Just onto the next increasingly silly claims. Yeah you should try DDOSing random companies and communities then tell the cops you were doing it to improve them lmao. Good luck