Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux AUR Repository Found to Contain Malware

sensorstechforum.com

Post reply on HN
Print view View original

51–60 of 137 posts

Re: Arch Linux AUR Repository Found to Contain Malware

#51

Post by Foxboron »

cakes wrote: post #40
jolmg wrote: post #28

Earlier quoted context omitted.

I've seen the advice of not installing AUR helpers multiple times before. I guess it works for many, but I feel it takes more discipline to review the files when not using AUR helpers since you can just download them and makepkg them immediately, while all AUR helpers I've seen explicitly ask you if you'd like to first review the files in an editor with a default answer of [Y]es.

One of the problem I see with helpers is that a lot of them start to wrap the whole user's package handling experience (pacman wrapping) where it seems like it would be easy to ignore the prompts and "just download the package already". You can tell users the AUR is unsafe and to review PKGBUILDs but that doesn't mean they are going to listen or do it. I did write a helper, mainly for myself and a few other arch user…

> The other point to this is how is this sort of compromise best communicated? It's important enough to hit [0] and obviously this news site, the mailinglist[1], but not the frontpage of arch itself.

I brought it up partially, and the simple explanation is; We don't. It's unsupported and compromised packages happens. There is no system in place to warn about it and the frontpage is reserved for news about issues regarding official packages.

Re: Arch Linux AUR Repository Found to Contain Malware

#52

Post by Foxboron »

Aardwolf wrote: post #32

Unfortunately lots of things one actually wants are on AUR, things like jpeginfo, golly, steam-fonts, simple-mtpfs, jslint, ... A case for putting more things in the main Archlinux repositories!

What packages would you like to se inn our repositories?

Re: Arch Linux AUR Repository Found to Contain Malware

#53

Post by Foxboron »

arendtio wrote: post #49
xiii1408 wrote: post #42

Earlier quoted context omitted.

My understanding is some things (e.g. Google Chrome, Google and Microsoft fonts) can't be put in the main Arch Linux repos for copyright reasons.

I wonder how other distributions solve that situation.

Distributing them as repackaged binaries would be against the terms. I'm unsure what distros ignores the terms and packages them anyway. It is a clear liability for any larger distributions at least.

Re: Arch Linux AUR Repository Found to Contain Malware

#54

Post by blfr »

arendtio wrote: post #49
xiii1408 wrote: post #42

Earlier quoted context omitted.

My understanding is some things (e.g. Google Chrome, Google and Microsoft fonts) can't be put in the main Arch Linux repos for copyright reasons.

I wonder how other distributions solve that situation.

By being popular enough to have providers package the software for them. For example, Chrome is available from a repo maintained by Google itself.

https://www.google.com/linuxrepositories/

OTOH, you're basically giving Google root access to your machine.

Re: Arch Linux AUR Repository Found to Contain Malware

#55

Post by cakes »

LukeShu wrote: post #15
chimeracoder wrote: post #2

The Arch User Repository hosts whatever people want to upload to it, with basically no proactive vetting whatsoever. In addition, the installation scripts run arbitrary code, a portion of which must run with root privileges. When a package gets orphaned, that means that anybody in the community can take over maintainership of the package. There's a whole lot of trust that has to go on when installing a package from t…

> yes, this is a fundamental problem with the security model of Arch Linux No, it's not. AUR is not Arch, and is not "supported" by Arch. It's a fundamental problem with the security model running code from randos on the internet. If someone published a git repo on GitHub that installed malware when you ran git clone git://github.com/user/repo . && ./configure && make && sudo make install you wouldn't be saying that…

I understand your point but the problem is that the title is "Arch Linux AUR Repository Found to Contain Malware" (and not, for example: "AUR Repository Found to Contain Malware"). I would argue that the implication (I guess reputation-wise if that matters) starts with the "Arch Linux" part. It's easy to jump on Arch because of this regardless of the fact that the AUR is not supported. At a cursory glance plenty of people (though incorrect) will equate this to "Arch Linux contains malware"

Re: Arch Linux AUR Repository Found to Contain Malware

#56

Post by Hello71 »

arendtio wrote: post #49
xiii1408 wrote: post #42

Earlier quoted context omitted.

My understanding is some things (e.g. Google Chrome, Google and Microsoft fonts) can't be put in the main Arch Linux repos for copyright reasons.

I wonder how other distributions solve that situation.

Either ignore them (Ubuntu) or they just don't. For many years Debian and Fedora didn't have MP3 decoder installed by default.

Re: Arch Linux AUR Repository Found to Contain Malware

#57

Post by oralty »

tombert wrote: post #7

I mean, is this new information? I always look at the upvotes on the package to see if it has been tested.

Not a great idea. Upvotes don't really tell you shit about testing, quality, or trust. I mean how many votes does acroread have (hint: a lot). The votes is merely to give arch some idea of how popular an AUR package is so that it can be absorbed officially.I have had a few of my AUR packages scooped up this way. Voting may indirectly indicate that the package is useful, but it doesn't say the thing doesn't contain malware nor does it indicate that the script is poorly written for other reasons. I orphaned a few quite popular AUR entries with high vote counts. The counts don't magically go away, and at that point anybody on the internet is free to adopt it.

Re: Arch Linux AUR Repository Found to Contain Malware

#59

Post by jolmg »

craftyguy wrote: post #39
jolmg wrote: post #37

Earlier quoted context omitted.

I think you misread. Pressing 'enter' opens up the editor to review the files. To ignore them, you'd have to answer [n]o.

Ah, in that case, most I've come across do not default to 'edit', but rather to accept. Notice that many default to automatic building: https://wiki.archlinux.org/index.php/AUR_helpers#Active

Huh. Thanks for the link; I hadn't realized that pacaur was announced unmaintained last December. I'll have to look for a replacement.

Re: Arch Linux AUR Repository Found to Contain Malware

#60

Post by Skunkleton »

westmeal wrote: post #22

Doesnt everyone know AUR packages are inherently unsafe? if you wanted to make sure they werent up to something you could read the pkgbuild

Given the design of most of the AUR "helpers" out there, I would guess that there are a non-trivial amount of users who view the AUR as safe.
Post reply on HN