<![CDATA[This smacks of a compromised something or other...]]>This smacks of a compromised something or other... why is an apt upgrade of firmware-b43-installer going to a childcare blog. A violin shop? Hmm... reinstalling this entirely.

(Update: this apparently WAS a bug, but has been fixed in more recent versions of Debian... but not old ones h/t @alienghic )

https://salsa.debian.org/debian/b43-fwcutter/-/commit/5a328aadbd836a27ea3c320645fede7f1d272905

https://media2.ai6yr.org/media_attachments/files/116/621/289/375/592/815/original/a6a89781847feba4.jpg

]]>https://bbs.spacc.eu.org/new/topic/68a77c17-90b7-41a2-a705-75930143ec87/this-smacks-of-a-compromised-something-or-other...RSS for NodeMon, 09 Nov 2026 21:29:45 GMTSat, 23 May 2026 01:29:37 GMT60<![CDATA[Reply to This smacks of a compromised something or other... on Sat, 23 May 2026 06:01:02 GMT]]>@ai6yr @alienghic
In case somebody else is wondering what happened like I did, this is what I've found

I see that there was a bug (bugs.debian.org/cgi-bin/bugrep…) and it was fixed with this commit (salsa.debian.org/debian/b43-fw…), but possibly only in oldstable (bookworm) and more recent releases.

And in the comments on the two links there are also reasons why the package is doing this download (lack of licensing permission for debian to host the firmware on their own infra :( ).

I believe that the system is probably still safe, because the downloader was checking a checksum of the downloaded file, unless it was using a compromised checksum algorithm, but then it would have been mentioned in the bug comments? I hope?

]]>https://bbs.spacc.eu.org/new/post/https://social.gl-como.it/objects/3e3ce0df-136a-1142-9eb3-70c360454883https://bbs.spacc.eu.org/new/post/https://social.gl-como.it/objects/3e3ce0df-136a-1142-9eb3-70c360454883Sat, 23 May 2026 06:01:02 GMT<![CDATA[Reply to This smacks of a compromised something or other... on Sat, 23 May 2026 03:58:30 GMT]]>@alienghic This, it turns out, is a package which pulls a firmware for a specific Broadcom card from an arbitrary URL. However, the source code for Debian is pulling from a URL which is NOT an actual repository... it's an arbitrary URL. Which appears to be part of a link farm of some sort.

]]>https://bbs.spacc.eu.org/new/post/https://m.ai6yr.org/users/ai6yr/statuses/116621882846546801https://bbs.spacc.eu.org/new/post/https://m.ai6yr.org/users/ai6yr/statuses/116621882846546801Sat, 23 May 2026 03:58:30 GMT<![CDATA[Reply to This smacks of a compromised something or other... on Sat, 23 May 2026 03:56:52 GMT]]>@ai6yr

Wait why is that in your apt sources file?

Normally your sources should just be pointing to the distro?

]]>https://bbs.spacc.eu.org/new/post/https://timeloop.cafe/users/alienghic/statuses/116621876446853749https://bbs.spacc.eu.org/new/post/https://timeloop.cafe/users/alienghic/statuses/116621876446853749Sat, 23 May 2026 03:56:52 GMT