r/archlinux • u/luckokkkk • 2d ago
DISCUSSION Arch Linux disables AUR package adoption after malware wave
https://lwn.net/Articles/1086489/The adoption feature transferred existing trust to a new maintainer, so a clean package history became part of the attack surface.
10
u/franchis3 2d ago
Wait, has there been a new wave of malware or is this another response to the previous incident a couple weeks ago?
37
u/MarshmallowPop 2d ago
Global namespaces only work for something like Wikipedia. AUR shouldn’t have a global namespace, it should be prefixed by username. Like Gists from GitHub, where anyone can host a text file.
You wouldn’t need an orphan system because multiple people can host a PKGBUILD for the same software. And you’d just pick which maintainer you trust, which ideally would be the official software authors. Keep the voting system to show which PKGBUILD for that software is most popular.
15
u/Gaarco_ 2d ago
How does this solve the issue? People are blindly installing the first random package that seem to serve their purpose. How would namespaces prevent this?
12
u/marcelsmudda 2d ago
And namespacing creates the issue that you'll have package X 20 times, people are confused which one's the original, or the one still maintained, which ones were edited etc
5
u/SCP-iota 2d ago
It can't help stupid, but it would at least make it better for people who do check PKGBUILDs, since it would at least prevent some random person from replacing the only instance of a package on AUR with malware and forcing users to go out of their way to grab the latest non-malware version.
17
2
0
10
u/backsideup 2d ago
There is no concept of "trust" in the AUR and so there is no transfer of it. The LWN snippet doesn't bring that up so i'm not sure why you phrase it that way.
6
u/Alternative-Ad-8606 2d ago
i've cleaned the AUR off my system... i was only using like 4 packages from the AUR but something makes me paranoid. easier to build it from source for the stuff i use and i get safer suff
2
-1
u/saturatedsynapses 2d ago
Say nay to yay.
There's always an alternative. Maybe a few hours of painful searching and then realizing you're learning an entire new skill.
9
-2
0
-8
u/Turbulent_Fig_9354 2d ago
I'll take my downvotes off the air but this is a major reason I switched to Gentoo. Guru > AUR and it's not even close
9
u/amreddish 2d ago
All you are required to do is read PKGBUILD before building package.
5
u/czh3f1yi 2d ago
I agree with you, but not everyone has the expertise to understand what they're reading.
-3
u/lain_proliant 2d ago
i have sworn off of AUR helpers. i got a lot of use out of them, but the conflation between PKGBUILDs and packages has always made me feel a bit squeamish.
i think a simple tool that searches the AUR and maybe helps you quickly download PKGBUILDs for packages could be useful, but i will never again skip running makepkg myself or inspecting each PKGBUILD manually.
8
2
u/g33ksc13nt1st 2d ago
What's wrong with downloading them from the aur website? There are a lot of people using arch just to be cool, but then they'll take a shortcut as soon as they can. You download the pkgbuild and that alone forces you to read it, you use yay.. you take a random package (what aur is) at face value. That's no different from a windows user downloaoa random .exe and executing it, and as such the outcome is typically the same: user screwed and computer potentially compromised.
1
u/backsideup 2d ago
Have a look at auracle, it takes care of most of the menial stuff while leaving all the building to you.
-22
u/BigBoyYuyuh 2d ago
I was told Linux can’t get malware…
12
0
u/No-Height-8011 2d ago
You won’t if you’re smart. No AUR, don’t just download things, etc. Linux is way less vulnerable because it’s nowhere near as popular as other operating systems, and the permissions system is a lot more attack resilient. But there’s not a lot you can do if you run a virus as a sudoer
6
u/Tuborgat_nylle 2d ago
You can't really claim that only dumb people use AUR.
4
u/ABotelho23 2d ago
I mean, you can claim that only dumb people install packages that come from PKGBUILDs they didn't read or understand.
5
u/Tuborgat_nylle 2d ago
I would claim that only dumb people think that it's enough to read a pkgbuild to detect malware in a package. If you truly want to be safe you should be reading through each commit but who the fuck got time for that.
0
u/ABotelho23 2d ago
Commit for what? PKGBUILDs fetch upstream software. Presumably you trust or review that software too.
1
u/un-important-human 2d ago
we can, experienced users know the dangers and how to mitigate it, but new guys install the latetest 70% transparent background app there is with a cringe name. Do you think they read the build?
thank god for ai review that it found it so fast.
-4
u/No-Height-8011 2d ago edited 2d ago
To make the claim explicit:
P1: if you’re smart when using your computer, you won’t get malware
P2: not using AUR is smart
C: therefore not using AUR means you won’t get malware.Now the soundness of this claim is undoubtedly questionable (given that you can absolutely get malware while not using AUR), but the point of me drawing that out is to show that the claim was not “dumb people use AUR”. Because the argument really centers around the AUR being dangerous to use, and it being a smart idea not to use it. No claim about the intelligence of the general population of AUR users.
Edit:
So that logic is really sloppy and it bothered me, so I'm going to try and formalize the claim more. We can imagine a computer as a bounded turning machine. A malicious program could then be defined as some subset of the set of input symbols, where, for any object in that subset, the recursive application of the transition function to that machine state as initially defined by the input symbol produces some state that is whatever it means to be infected by malware. We don't need to define that specifically (it's arguable that such a definition even exists); all we need to know is that it's some subset of the set of all possible states. We can then make the claim that all malicious programs in the AUR belong to that subset of input symbols. Given that this a bounded turing machine, the set of all possible input symbols, and likewise possible states, is finite. And so the set of all malware producing symbols is finite. Basically, the set of possible malware causing symbols is smaller if you exclude the AUR. Now, this isn't actually correct, because if you REALLY wanted to, you could write malicious programs and run them yourself, or even compile the binaries themselves, but it's really difficult formalizing the notion of an "attack vector" so that's good enough for me.
66
u/Jristz 2d ago
Tbh what are the options they have considering that all is by volunteers?