• thingsiplay@lemmy.ml
    45·
    5 months ago

    As an user of the AUR, this is devastating news to me. I am also guilty of accepting updates without reading the latest changes, even if yay asks me if I want to. This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer. And to at least have a look if something suspicious is going in with the recent changes in the package recipe. AND to read in the communities and news.

    I don’t understand why there still no official announcement as a warning from the Archlinux team at https://archlinux.org/news/ . Is there a different place for security news specifically about the AUR to subscribe to? EDIT: https://archlinux.org/news/active-aur-malicious-packages-incident/ They did it, an official message.

    • trevor (any/all) @lemmy.blahaj.zoneEnglish
      311·
      5 months ago

      The fact that the Arch maintainers seem to prefer Reddit over their own fucking news channel is what made me switch from Arch years ago. I got sick of upstream breaking changes fucking my system because they wouldn’t notify people through official channels, only to find it later on /r/archlinux 🙄🙄🙄

      • Tanka@lemmy.mlEnglish
        3·
        5 months ago

        What are you using now?

        After the end of Win10 I moved to arch but I think my week end will be filled with moving again. ^^

        • trevor (any/all) @lemmy.blahaj.zoneEnglish
          5·
          5 months ago

          On my desktop, CachyOS 💀

          It was years ago when Arch pissed me off, but I couldn’t resist Arch-based distros forever. So far, I haven’t been burned.

          On my laptop, Asahi Linux, which is basically Fedora ARM with a custom kernel. I’d recommend Fedora to most general users.

    • araneae@beehaw.org
      5·
      5 months ago

      This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer.

      Unfortunately not foolproof either. I have no infected packages that I know of because I happen to be on a new install, but I caught wind of the LAST AUR botnet infiltration and switched to flatpaks or source builds. Since then I drifted back to AUR for convenience. I thought I was being clever only using AUR packages when I could be “sure” the author of the original software package pushed to AUR, and this was easy since devs who build on Arch typically recommend AUR whether they maintain the package or not. Today I found out spoofing package ownership is apparently easy and so is spoofing git credentials.

      I was on Endeavour and it was incredible, but I’m not That Power User and I feel like part of the problem. The worst part of all of this is its owing to an influx of users who want the same ease of use they used to enjoy, but in Windows SOP is installing whatever the fuck you want on Internet Explorer and bugging your sysadmin to fix whatever happens. Its probably really hard to be any kind of FOSS developer right now.

      • thingsiplay@lemmy.ml
        3·
        5 months ago

        Yes, definitely not foolproof. This is more of a wake up call to be at least careful and reconsider every single AUR package one has installed. For me, I was lucky too. But in my case it wasn’t pure luck that the few AUR packages I have installed aren’t affected. See, because since years using the AUR (sparingly! including my own package :D ) I always feared off orphaned packages and removed them as soon as I could. This incident here is proof I was right.

        For some stuff I also prefer the Flatpak, because I do not trust everyone on the AUR, as they operate on root rights! When I brought this up on Endeavor, they disliked my opinion (as a fresh user) and the trusted community members there explained to me that the AUR is way more safe than Flatpak, because there is a trust system of upvotes and everyone can flag the packages, and that Flatpak has a wrong sense of security. That is what they told me and totally ignored my issues with AUR… one of the reasons why I do not visit the EndeavourOS community… I digress…

    • taiyang@lemmy.world
      7·
      5 months ago

      Useful list for those who do use Arch; I’ve only got like two things from AUR and neither is on that list (although I kinda recognize a couple with slightly different names, like what, knock off plugins for official stuff?)

    • thingsiplay@lemmy.ml
      82·
      5 months ago

      Reading the manual clearly won’t help with the issue here. This is clearly not an appropriate use of RTFM terminology here, because it does not apply. The problem here is not that the user needs to read before asking for help. The problem here is to understand the changes made in the script are malicious. And reading the manual won’t help with that.

  • James@lemmy.ca
    8·
    5 months ago

    The AUR is basically just a shortcut for downloading random shit off GitHub.

    It gives un-experienced users a false sense of security.

  • sonofearth@lemmy.world
    71·
    5 months ago

    Maybe maintenance of packages shouldn’t just be handed over to newly created accounts. This is a design flaw on AUR’s part. As Linux popularity rises, these types of attacks will just keep growing. There should also be some sort of system where it is easy to verify that the maintainer of the package is also the actual developer. Like brave-bin has brave has the maintainer who are also the creator. Just give a green check mark to them or something.

    • bitfucker@programming.dev
      22·
      5 months ago

      Or maybe don’t use AUR blindly? You’re doing the equivalent of sudo curl --- | bash. Who knows what the script is doing. So only do it if you truly trust it. That’s why we have warnings plastered all over. That’s also why a warning label and sticker exists. And this is precisely the reason easy no user input AUR helpers are greatly discouraged

      • sonofearth@lemmy.world
        2·
        5 months ago

        That’s why we have warnings plastered all over.

        Plastering warning labels everywhere is a cheap way to shift 100% of the accountability onto the user. Security should be built into the AUR’s design (throttling new accounts, forcing forks for orphaned takeovers or maintainer-developer verification), not outsource your job to the users as a reading assignment before every system update. Humans are the final layer of defense not the first.

        Or maybe don’t use AUR blindly? You’re doing the equivalent of sudo curl — | bash… So only do it if you truly trust it.

        There is a massive difference between blindly curling a random script from the open web and using a centralized, organized community repository. Yes AUR helpers are not recommended but they exist and are used by majority of Arch users and you can’t expect the user to know code and pkgbuilds especially when distros like CachyOS make it so damn easy to install the OS with AUR being just a checkbox away.

        • bitfucker@programming.dev
          12·
          5 months ago

          You said it yourself that it is a community repository. No difference between that and the internet forum. You are putting the burden of accountability on the maintainer that way. Which I would remind you, is unpaid unlike say, github and npm that HAS a financial means to do a lot of security implementation. Yet those platforms still fail to do it.

          Also, humans ARE the first layer of defense. Because anything you do on your device (on linux anyway, and specifically arch) is YOUR decision. Antivirus and everything else should kick in when the human fails.

          You are normalizing people downloading things off the unvetted internet like on windows. Linux has a vetted repo already. THOSE are what people should be using and I’m fine with if those are being blamed. Everything else is USER due diligence. That is why the existence of easily installing malware like limewire does not justify blaming the platform. Or do you also blame torrenting site when they are chock full of malware?

          • sonofearth@lemmy.world
            1·
            5 months ago

            Fine agree with all of what you say. But still the AUR is the only repo where this happens majority of the times. So what to do next? I am sure the solutions I mentioned in a comment below are not that difficult to implement.

            • bitfucker@programming.dev
              11·
              5 months ago

              Sure, your proposed solution is a good way to weed out the low hanging fruit. But I don’t like that it may create friction for normal users. AUR was never meant to be a FOSS project on its own with a full time maintainer that maintains PKGBUILD and the infra.

              Like I said before, it is more akin to an internet forum and pastebin more than a full fledged package repository. And to be fair, it isn’t a package repo anyway. It’s like a cmake / makefile sharing site. Building and packaging for arch is just that easy compared to say, debian.

              If people want to use a repo, there is chaotic aur. Maybe that could be the way too. A dedicated community project to vet the AUR. Or the project maintainer itself could provide a pkgbuild directly on their repo.

              Just don’t ever blame the maintainer for providing a place to store something for free and open to anyone. Especially if it is your choice to get something from said place and be surprised that it is malware.

  • zipkag@lemmy.world
    2·
    5 months ago

    Maybe someone here can advise. I ran two of the available “checking” scripts to see if I have any packages installed. Both came up with 1 package I have installed. It is gtkimageview, which is on the list.

    However, if I look through the pacman.log I see it was installed on 2024-10 and last upgraded 2025-01. It seems to me that suggests I installed it before this all started, so I’m probably not infected?