Hi everyone :).
Just getting started with Manjaro as daily drive to get some easier arched based distro. Except for the LVM bug with calamares everything is pretty smooth :).
But at first boot, I saw they have added their personal Manjaro logo on boot and I directly though of the bug exploit logoFAIL I heard a few month ago and It made me curious if this is something that could be exploitable by Manjaro.
Probably not, this would harm their image and hard worked system, but I’m still curious… If someone smarter/more knowledgeable than me could chime in and give some valuable information on this topic regarding Manjaro, I would really appreciate it !
Thank you !
No. This gets painted on the framebuffer when the OS boots up, it’s after firmware is done with it. It’s barely any different than when full graphics mode load up.
LogoFAIL is based on replacing the BIOS logo with one that will trigger the exploit in firmware code, before the OS even starts.
This is a bios problem. So just update your bios.
Manjaro damaging it’s image wouldn’t be a new thing. That’s mostly dust at this point. No though, as others have explained this isn’t an issue, currently
Manjaro damaging it’s image wouldn’t be a new thing.
Could you elaborate? :)
Manjaro is run by people who don’t know what they are doing. They make huge mistakes frequently and don’t really understand Linux, the internet or project management.
absolutely, thank you for asking
Manjaro has been continuously destructivte to the open source ecosystem it utilizes and it’s users through continual incompetence.
Manjaro and it’s staff often suggested to users that they use “pacman -Syyu” by default to update, which ignores caching to get a reloaded database. This puts a heavier load on the volunteers hosting the repos.
Manjaro made a campaign stating that “Manjaro works on the m1 apple macbook!” Shipping a random kernal from asahi linux which did not work at all. The project was nowhere near ready at the time and could never boot. This wasn’t the latest build either, just some random build. This build could have easily broken users macbooks.
Back to the asahi, when it did work they pushed an update to the kernal that broke half the users gui. This by updating a library which was documented to break in this manner. It broke all x11 instances showing they didn’t even run it to ensure it worked. No benefit existed from updating either more was it stated to be the goal of their patch. The reason it wasn’t checked by the devs is due to the fact the patch came from the lead arm dev of manjaro. This man should know better.
On the funding of manjaro, a company, things have been a little funky. After a spat between their treasurer and leader of the project the treasurer either left or was removed. Now, what happened is blurry, but now the sole person in charge of money is that leader who has never appointed a new treasurer as they stated they would. Atleast since last I checked. If the previous treasurer is right this person was utilizing development funds to acquire a powerful gaming laptop. Something which is directly against the stated purposes this company may use money, and the responsibility of a treasurer to deny.
They let their ssl run out 5 times. 5 times. I am a web dev, this shouldn’t happen once. One can automatically renew it. This shows their continual incompetence. The first time, they suggested users set back their clocks so it would stop complaining.
Manjaro ddosed the aur twice using their tool pamac. Both in the same manner showing once it had happened nothing changed to ensure it couldn’t twice. This was not malice of course, just an mistake twice made.
Back to the aur, though many will never have an issue as they only use it for general programs they don’t hold it back that two week period so version mismatches can break that which is installed from the aur.
Still on the aur, the ability to enable it is right next to flat packs and snaps in pamac. Both are relatively safe, unlike the aur. They do not properly warn users about the aur. I’ll admit this to be a lesser thing, but anyone using the aur should know it’s faults. It’s just a list of scripts which your pc will run to install a package that’ll auto update to the next version of a script when updating. This means, basically anything can be put inside there. By design too this is rarely maintained by the devs of a project. One issue which came up, the cemu emulator a very commonly used package had to calls to an IP logger alongside a list of people who can “go fuck themselves”. If you let this update without reading it you can recieve malicious updates. When malware exists and propagates on linux the aur is the first place it’ll go. You need to be able to read the scripts and do so each update . The air is a very useful tool but a dangerous one.
There’s more out there but I’m going to leave it here. Sorry for the rambling nature, but I’ a bit tired right now
The ddos thing could happen from an actual attack. Arch should really look into building up better defenses against attack. It is dumb that it came from an actual distro but technically it could come from anywhere.
Thank you very much for your throughout and explanatory response !!! <3 I also read all the comments and I know what I will be doing !
While I did like the well build defaults, I didn’t liked how they added their logo on boot up, even if it has nothing to do with logoFAIL exploit, It felt wrong (or does every distro does that?). Also the fact they added their own bookmarks in my freshly installed Firefox left me a bit skeptical… :/
There’s probably nothing to be alarmed off but That doesn’t feel right… If they do that, what else could they add hidden in the distro normal people can’t see ?
If I may ask, do you have any good distro you would recommend? Something as bare bone as possible, as good as debian but a bit more up to date. I do not fear some tinkering with a new distro but Arch is a bit to much of a hassle right now… That’s why I chose Manjaro.
My second pick was EndeavourOS as daily drive, but the community is small compared to manjaro and it’s relatively new in the game. Any thoughts?
Thank you !!
They’ve let their site certificates expire a few times and told their users to set their clocks back to get around the issueand they’ve accidentally ddosed the aur a couple of times with their package management tools.
There’s a small but vocal minority that absolutely hates the idea of “Arch made easy”. They think you should work hard to be worthy of using Arch. Manjaro is their anti-Christ. They show up in every conversation about Manjaro. I call them the “Manjaro sucks btw” people. 😆
They usually mention some irrelevant shit that happened years ago. Sometimes they can’t be bothered to type it out and only link to a page that one of them put up. Or literally just say “Manjaro sucks”. Sadly, the irony of being lazy when smearing a distro they consider lazy is lost on them.
If it was some minor thing I wouldn’t care much. I am not a Arch user and I probably will never be.
The problem with Manjaro is the leadership is questionable. It isn’t just a few blunders. It is repeated mistakes that have caused real harm. They write themselves off as user friendly but they can’t seem to figure out how to manage it properly. I am not against user friendly Arch. However, the nature of Arch means it is very very hard.
Linux Mint and Fedora are much better and don’t have the same history of dumb mistakes.
I would absolutely love it if manjaro was a reasonable choice. It was my first pick too. Their continual incompetence is what makes me wary of the company. I doubt you want a conversation as you’re quick to paint me in this light but I do expand here on my major reasons:
https://sh.itjust.works/comment/12137275
Some of this stuff happened only a few years ago. The same people are still running this company. I have no reason to think they’ve changed.
If you just want “arch made easy” I would suggest endeavorOs (best wallpapers hands down) or arco linux.
I love the idea of manjaro and sincerely hope that either a, they get their shit together (which is preffered), or b, a new manjaro like distro comes into existance.
The two week delay along with the calamari installer, and default plasma desktop give me a half chub already thinking about it. I’d be full send for it if the devs were competent
