Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux AUR Repository Found to Contain Malware

sensorstechforum.com

Post reply on HN
Print view View original

121–130 of 137 posts

Re: Arch Linux AUR Repository Found to Contain Malware

#121

Post by rcxdude »

mikekchar wrote: post #103
chias wrote: post #50

Earlier quoted context omitted.

AUR is not an "official" repository at all -- indeed the acronym stands for "Arch User Repository". Kinda like github, you can go put whatever you want in there, and people can download and install it on their machines if they want to. The "correct" way to install something from AUR is to go grab the install script, READ THROUGH IT CAREFULLY, then knowing that you just downloaded a thing uploaded by someone unafillia…

> a good idea? it's your system, you decide (my opinion is 'no'). This frustrates me. Because there is a large vocal group that opposes the use of yaourt (the most popular AUR package manager), I spent a year building packages by hand, just to see if there was something I was missing. I was not. It's just a complete PITA. In the end, I wrote scripts that just about duplicated yaourt -- checks for new versions of pack…

AFAIK yaourt specifically is discouraged because its possible for a malicious PKGBUILD file to execute code before it is displayed to you (as a consequence of the way yaourt parses the files). Other AUR helpers do not have this problem.

Re: Arch Linux AUR Repository Found to Contain Malware

#123

Post by heywire »

BurningCycles wrote: post #94
mehrdadn wrote: post #90

Earlier quoted context omitted.

How are official Arch packages vetted?

They are built by the core Arch developers, or as in the case of the 'community' repo, by 'Trusted Users', the latter being people who have done high quality maintaining of packages in the AUR and shown good community involvement. Having met these criterias, they need to be sponsored by an existing TU, and then it will be put up to a vote.

Do you know if there is any kind of review process? For example, let’s say a core maintainer’s machine is compromised and the attacker submits a new package on their behalf. Does anyone else need to review and sign off on the new package?

Re: Arch Linux AUR Repository Found to Contain Malware

#124

Post by Foxboron »

hardenedmetapod wrote: post #112
Foxboron wrote: post #52

Earlier quoted context omitted.

What packages would you like to se inn our repositories?

>Not spelling AUR right Honestly AUR has covered everything I've needed.

I package for Arch so the question is what the author wants in our repositories. Not in AUR.

Re: Arch Linux AUR Repository Found to Contain Malware

#125

Post by pritambaral »

Aardwolf wrote: post #82
Foxboron wrote: post #73

Earlier quoted context omitted.

>simple-mtpfs Not maintained (last commit in 2016). So that will be something low on the priority list. >btrfs The dedupe tool looks interesting. Noted on my todo. >closure-compiler Was dropped from the repository. Probably because of the lack of an maintainer.

> Not maintained (last commit in 2016). So that will be something low on the priority list. I see! Time for me to start looking for a new method of transfering files from android then, thanks for the heads up

KDE Connect allows transferring individual files or browsing the Android filesystem, in addition to all its other goodies.

Re: Arch Linux AUR Repository Found to Contain Malware

#126

Post by cmiles74 »

mikekchar wrote: post #103
chias wrote: post #50

Earlier quoted context omitted.

AUR is not an "official" repository at all -- indeed the acronym stands for "Arch User Repository". Kinda like github, you can go put whatever you want in there, and people can download and install it on their machines if they want to. The "correct" way to install something from AUR is to go grab the install script, READ THROUGH IT CAREFULLY, then knowing that you just downloaded a thing uploaded by someone unafillia…

> a good idea? it's your system, you decide (my opinion is 'no'). This frustrates me. Because there is a large vocal group that opposes the use of yaourt (the most popular AUR package manager), I spent a year building packages by hand, just to see if there was something I was missing. I was not. It's just a complete PITA. In the end, I wrote scripts that just about duplicated yaourt -- checks for new versions of pack…

In my opinion, this is a hard problem and not one that we can expect Arch Linux to take on or solve. We're talking about how we establish that a software package (source code, build script, binaries, etc.) can be deemed trustworthy such that we feel comfortable installing it onto our machine (which may hold important data, personal, financial, etc.) I don't think anyone has a good solution, with the Apple App Store at one extreme and (in my opinion) something like AUR at the other.

Arch discourages tools like yaourt because it makes it so easy to install some an unvetted package and that opens you up to the very real risk of installing malware. As you point out, downloading the package and building it isn't any safer if you don't read through the script. It's easy to make the argument that a casual read through of the package file will only catch the most obviously bad packages and a clever person could easily find better ways to hide their malware payload, so why bother looking at all?

If you aren't going to read the package files, you may as well use a tool like yaourt; there's effectively no difference. In my own experience it's rare that I have to install something from AUR so I can take the time to briefly scroll through the package files and check where the source code is coming from, easy stuff like that.

In the back of my mind, I understand I'm taking a risk; I think that's what Arch is trying to accomplish by discouraging tools like yaourt.

Re: Arch Linux AUR Repository Found to Contain Malware

#127

Post by dozzie »

m45t3r wrote: post #63
dozzie wrote: post #46

Earlier quoted context omitted.

> It's an important distinction because if the software isn't at fault, [...] Though the software is at fault. It created a false sense of security, misleading the users. What else in Arch just feels secure, but in fact is not? And then, if the users around the software generally exhibit a jockey attitude, you get the whole environment built in a similar manner, not a robust one. The software may technically not be a…

> Though the software is at fault. It created a false sense of security, misleading the users. What else in Arch just feels secure, but in fact is not? AUR never tried to pass false sense of security, it is explicitly declared as not supported everywhere. > And then, if the users around the software generally exhibit a jockey attitude, you get the whole environment built in a similar manner, not a robust one. The sof…

> AUR never tried to pass false sense of security, it is explicitly declared as not supported everywhere.

Funny that I only ever hear of this when talking about security aspects, not when discussing available software. In the latter case I always hear how many things are there in AUR, especially comparing to Debian. AUR must have failed miserably in not trying to pass false sense of security.

Re: Arch Linux AUR Repository Found to Contain Malware

#128

Post by semi-extrinsic »

JackCh wrote: post #25
Foxboron wrote: post #20

Earlier quoted context omitted.

All of the Arch Linux infrastructure is run on Arch. Works pretty well.

There is an expectation that projects dogfood their own software, but I really can't think of a rational reason for a production server not affiliated with the Arch project to be running Arch. Rolling release is great for technically competent users to install on their workstations, but why would you ever want a rolling release on a production server?

Well, one thing which I know of several projects doing, is having an Arch server as one of the continuous testing servers. This way you can test against bleeding edge gcc/glibc/whatnot and catch bugs or breaking API changes long before they appear in major distros.

Re: Arch Linux AUR Repository Found to Contain Malware

#129

Post by ilikehurdles »

westmeal wrote: post #22

Doesnt everyone know AUR packages are inherently unsafe? if you wanted to make sure they werent up to something you could read the pkgbuild

Honestly, no, not everyone knows this. Maybe when there was just arch linux and no spinoffs; but manjaro provides an easy path to a rolling-release arch(-like) distribution, and it treats AUR as a first-class citizen in its GUIs. I think there was a popup at some point when an application first accesses AUR that tells you that AUR is unsupported and to go to a wiki to understand it, but I think it could use better messaging. A warning at the header of the AUR section of the package manager gui would be a good start.

Re: Arch Linux AUR Repository Found to Contain Malware

#130

Post by Grimm665 »

delbel wrote: post #110

I tried installing Arch Linux, and it was harder then installing SunOS 4.3. The instructions were absolutely wrong. I wish I could give it another try, but I just don't have time to experience the wow's of the early 90s just to get a browser up.

The Arch wiki used to have an amazing Beginner's guide along with the general Installation Guide. They've since dropped it from the wiki, but there are archived versions that I still bring up every now and then when setting up a new Arch install. Here's one: https://csdietz.github.io/arch-beginner-guide/
Post reply on HN