Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux AUR Repository Found to Contain Malware

sensorstechforum.com

Post reply on HN
Print view View original

31–40 of 137 posts

Re: Arch Linux AUR Repository Found to Contain Malware

#31

Post by craftyguy »

jolmg wrote: post #28
craftyguy wrote: post #16

Earlier quoted context omitted.

Yes, but this may be a good reminder for fellow Arch users who have grown complacent reviewing things they install from AUR. I've gotten to the point where I do not install any AUR helpers on my systems, and manually download PKGBUILDs and install with makepkg. These extra steps force me to 1) review the PKGBUILD + *.install files, and 2) make me reconsider whether or not I want to go through the effort for a package…

I've seen the advice of not installing AUR helpers multiple times before. I guess it works for many, but I feel it takes more discipline to review the files when not using AUR helpers since you can just download them and makepkg them immediately, while all AUR helpers I've seen explicitly ask you if you'd like to first review the files in an editor with a default answer of [Y]es.

> while all AUR helpers I've seen explicitly ask you if you'd like to first review the files in an editor

The good ones do, yes.

> with a default answer of [Y]es.

And therein lies the problem. You may review a handful up front, but then convince yourself that all is good since it's much easier to just press 'enter' and move on. It's MUCH easier to ignore a PKGBUILD when you have to hit one key to skip it than it is if you have to manually download it, put it somewhere, and 'makepkg' on it.

Re: Arch Linux AUR Repository Found to Contain Malware

#33

Post by ploxiln »

21 wrote: post #13
cmiles74 wrote: post #4

From the article: "This is yet another incident that showcases that Linux users should not explicitly trust user-controlled repositories." LOL. Why should this only apply to Linux users? We should all be wary of downloading random things from websites. AUR has always been labeled "user submitted", but I guess it's easy to forget that some "users" are really out to cause harm.

Because there is this myth that only Windows users get infected because Windows is insecure, that packages are vetted, that code being open source means that a backdoor insertion would quickly be discovered, and so on.

Packages are vetted, in the repos, just not in AUR.

They also keep tools that would easily/automatically build and install packages from AUR out of the main repos, to encourage manual handling and individual consideration of AUR package build scripts.

Also this malware was found in AUR within a few hours of it going up.

Re: Arch Linux AUR Repository Found to Contain Malware

#34

Post by dozzie »

JackCh wrote: post #29
dozzie wrote: post #17

Earlier quoted context omitted.

Which, as I said, very conveniently is glossed over by Arch users.

That's a problem with Arch users, not with Arch. It's unfortunately common that fanboys undermine the reputation of reasonable software.

Oh yes, it is a problem with the users, not the software itself, but you don't get to separate the two in the case of an OS or distribution.

Re: Arch Linux AUR Repository Found to Contain Malware

#35

Post by Foxboron »

JackCh wrote: post #25
Foxboron wrote: post #20

Earlier quoted context omitted.

All of the Arch Linux infrastructure is run on Arch. Works pretty well.

There is an expectation that projects dogfood their own software, but I really can't think of a rational reason for a production server not affiliated with the Arch project to be running Arch. Rolling release is great for technically competent users to install on their workstations, but why would you ever want a rolling release on a production server?

You wouldn't. The only reason why we run it is because we know it. I wouldn't have used Arch on any production things personally.

Re: Arch Linux AUR Repository Found to Contain Malware

#36

Post by CodyReichert »

jdlyga wrote: post #26

This is exactly what we've been preparing for. Don't use yaourt, and read those diffs. I know a lot of people don't do this, but it's important.

Yeah it's funny, my first thought was since I started using Arch, the most common thing I hear people say is that packages from AUR should be considered unsafe until you've read the PKGBUILD, at least. It's a good thing it gets brought up so much, unfortunately.

Re: Arch Linux AUR Repository Found to Contain Malware

#37

Post by jolmg »

craftyguy wrote: post #31
jolmg wrote: post #28

Earlier quoted context omitted.

I've seen the advice of not installing AUR helpers multiple times before. I guess it works for many, but I feel it takes more discipline to review the files when not using AUR helpers since you can just download them and makepkg them immediately, while all AUR helpers I've seen explicitly ask you if you'd like to first review the files in an editor with a default answer of [Y]es.

> while all AUR helpers I've seen explicitly ask you if you'd like to first review the files in an editor The good ones do, yes. > with a default answer of [Y]es. And therein lies the problem. You may review a handful up front, but then convince yourself that all is good since it's much easier to just press 'enter' and move on. It's MUCH easier to ignore a PKGBUILD when you have to hit one key to skip it than it is i…

I think you misread. Pressing 'enter' opens up the editor to review the files. To ignore them, you'd have to answer [n]o.

Re: Arch Linux AUR Repository Found to Contain Malware

#38

Post by JackCh »

dozzie wrote: post #34
JackCh wrote: post #29

Earlier quoted context omitted.

That's a problem with Arch users, not with Arch. It's unfortunately common that fanboys undermine the reputation of reasonable software.

Oh yes, it is a problem with the users, not the software itself, but you don't get to separate the two in the case of an OS or distribution.

> "but you don't get to separate the two in the case of an OS or distribution."

Actually I do get to do that. It's an important distinction because if the software isn't at fault, then a technically competent user can safely use it by merely not being as dumb as the average user. But if the software itself is at fault, then the technically competent user should stay clear of it. Idiots will be idiots no matter the distribution. If it weren't arch, they might be downloading third party RPMs or debs from untrusted sources. Would that be reason for a technically competent person to avoid RHEL or Debian? Of course not.

Re: Arch Linux AUR Repository Found to Contain Malware

#39

Post by craftyguy »

jolmg wrote: post #37
craftyguy wrote: post #31

Earlier quoted context omitted.

> while all AUR helpers I've seen explicitly ask you if you'd like to first review the files in an editor The good ones do, yes. > with a default answer of [Y]es. And therein lies the problem. You may review a handful up front, but then convince yourself that all is good since it's much easier to just press 'enter' and move on. It's MUCH easier to ignore a PKGBUILD when you have to hit one key to skip it than it is i…

I think you misread. Pressing 'enter' opens up the editor to review the files. To ignore them, you'd have to answer [n]o.

Ah, in that case, most I've come across do not default to 'edit', but rather to accept. Notice that many default to automatic building: https://wiki.archlinux.org/index.php/AUR_helpers#Active

Re: Arch Linux AUR Repository Found to Contain Malware

#40

Post by cakes »

jolmg wrote: post #28
craftyguy wrote: post #16

Earlier quoted context omitted.

Yes, but this may be a good reminder for fellow Arch users who have grown complacent reviewing things they install from AUR. I've gotten to the point where I do not install any AUR helpers on my systems, and manually download PKGBUILDs and install with makepkg. These extra steps force me to 1) review the PKGBUILD + *.install files, and 2) make me reconsider whether or not I want to go through the effort for a package…

I've seen the advice of not installing AUR helpers multiple times before. I guess it works for many, but I feel it takes more discipline to review the files when not using AUR helpers since you can just download them and makepkg them immediately, while all AUR helpers I've seen explicitly ask you if you'd like to first review the files in an editor with a default answer of [Y]es.

One of the problem I see with helpers is that a lot of them start to wrap the whole user's package handling experience (pacman wrapping) where it seems like it would be easy to ignore the prompts and "just download the package already". You can tell users the AUR is unsafe and to review PKGBUILDs but that doesn't mean they are going to listen or do it.

I did write a helper, mainly for myself and a few other arch users I know, and if not for having completed it enough to use it, I wouldn't do it again (I don't support pacman wrapping). I use like 5-10 packages from the AUR and I either maintain them or they _never_ change and I would know something is wrong.

The other point to this is how is this sort of compromise best communicated? It's important enough to hit [0] and obviously this news site, the mailinglist[1], but not the frontpage of arch itself.

[0] planet.archlinux.org [1] https://lists.archlinux.org/pipermail/aur-general/2018-July/...

Post reply on HN