Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Installing Every Arch Package

ta180m.exozy.me

Post reply on HN
Print view View original

81–90 of 90 posts

Re: Installing Every Arch Package

#81

Post by easrng »

kevincox wrote: post #36
iqanq wrote: post #18

Earlier quoted context omitted.

No, what I am referring to is that they show me a captcha page that they have ripped off from cloudflare.

It is shockingly similar looking. At first I thought they were on an expensive enough Cloudflare plan to remove branding. But 1. the site owner has beef with Cloudflare and 2. Cloudflare doesn't use recaptcha anymore so it does just seem like a very similar theme (IDK if it was actually copied or not, it is not that complex of a design).

It was copied. It's all inline styles with some redundant definitions just like their archiver outputs.

Re: Installing Every Arch Package

#82

Post by easrng »

kevincox wrote: post #36
iqanq wrote: post #18

Earlier quoted context omitted.

No, what I am referring to is that they show me a captcha page that they have ripped off from cloudflare.

It is shockingly similar looking. At first I thought they were on an expensive enough Cloudflare plan to remove branding. But 1. the site owner has beef with Cloudflare and 2. Cloudflare doesn't use recaptcha anymore so it does just seem like a very similar theme (IDK if it was actually copied or not, it is not that complex of a design).

Also you can check /cdn-cgi/trace to see if a site is on cloudflare.

Re: Installing Every Arch Package

#83

Post by akerl_ »

sudosysgen wrote: post #79
akerl_ wrote: post #71

Earlier quoted context omitted.

The unofficial ones are ~40 lines of shell script that generally start by pulling down a VCS repo or tarball from somewhere. They check the checksum of tarballs, but if you’re pulling from the AUR you’re trusting not just the ~40 lines but also the much larger body of code that’s getting fetched.

No package maintainer is verifying the code of every update of the software they're packaging. Those 40 lines of shell script are the only relevant difference between packages and the AUR, security wise.

In the core repos, those 40 lines still exist. The AUR and core repos use the same PKGBUILD scripts. So the shell script isn’t a difference between core and AUR packages.

As for the security review, I’d agree that no maintainer is verifying the code in every update of the software they’re packaging. This doesn’t mean that, as implied in the comment I replied to, you only have to review the 40 lines. It means that you’re accepting risk or accepting workload in either case (or both!), depending on how deep you look into the supply chain.

Re: Installing Every Arch Package

#84

Post by sudosysgen »

akerl_ wrote: post #83
sudosysgen wrote: post #79

Earlier quoted context omitted.

No package maintainer is verifying the code of every update of the software they're packaging. Those 40 lines of shell script are the only relevant difference between packages and the AUR, security wise.

In the core repos, those 40 lines still exist. The AUR and core repos use the same PKGBUILD scripts. So the shell script isn’t a difference between core and AUR packages. As for the security review, I’d agree that no maintainer is verifying the code in every update of the software they’re packaging. This doesn’t mean that, as implied in the comment I replied to, you only have to review the 40 lines. It means that you…

Yes, of course, the 40 lines still exist for the core repos, but the maintainers are presumably trusted.

I agree with the rest, I'm really talking more about the comparative risk from AUR compared to the repos. The real danger is that someone snuck something malicious in the PKGBUILD and that no one noticed yet. Other than that, the threat is the same as using the repos, assuming you trust the maintainers, which is IMO a reasonable assumption if you're already using it as your distro.

Re: Installing Every Arch Package

#85

Post by majewsky »

bee_rider wrote: post #77

For some reason I feel bad downloading too many unnecessary packages from these volunteer projects. I guess any given mirror must have enough users that even something like this is just a raindrop in the ocean, though?

I run an Arch Linux mirror. [1] The server hosting the mirror is averaging 1 MiB/s (8 Mib/s) outgoing traffic. There's quite a bit of fluctuation since package downloads are a very spotty load, but overall I don't think the server is breaking a sweat at all. CPU usage is pretty flat at 5% (of 1 vCPU). The same server is also hosting approx. 10 other websites, but the mirror causes most of the load by far from what I can tell.

[1] This is n=1 data because I can only speak for my own machine, so obviously take this with a grain of salt.

Re: Installing Every Arch Package

#86

Post by Diti »

jonringer117 wrote: post #65

Copying my comment from reddit[0]: For clarity, Arch has about 10k packages, AUR has around 60k packages. I believe this post is "just" about the 10k. > I’d like to see someone do this for Ubuntu, Debian, and NixOS and watch them suffer. Speaking for NixOS: I have. I would sometimes do a nixpkgs-review[1] of the mass "rebuild" PRs for Nixpkgs[2]. Hard to know how long it took to build as I would just let it "cook" on…

Installing every single Nix package is a piece of cake. Just run nix-env -i without argument.

Nix has been behaving that way for at least 8 years: https://github.com/NixOS/nix/issues/308

Re: Installing Every Arch Package

#87

Post by jonringer117 »

Diti wrote: post #86
jonringer117 wrote: post #65

Copying my comment from reddit[0]: For clarity, Arch has about 10k packages, AUR has around 60k packages. I believe this post is "just" about the 10k. > I’d like to see someone do this for Ubuntu, Debian, and NixOS and watch them suffer. Speaking for NixOS: I have. I would sometimes do a nixpkgs-review[1] of the mass "rebuild" PRs for Nixpkgs[2]. Hard to know how long it took to build as I would just let it "cook" on…

Installing every single Nix package is a piece of cake. Just run nix-env -i without argument. Nix has been behaving that way for at least 8 years: https://github.com/NixOS/nix/issues/308

Oh, nix-env.... The tool which attempted to bridge the worlds of nix and traditional package managers. But has all of the quirks of both.

Re: Installing Every Arch Package

#88

Post by Abishek_Muthian »

no_time wrote: post #14

Now install every AUR package. Bonus points for heuristically looking for cryptominers after it's done.

I recently found that brltty/orca package on Arch conflicted with CH340 driver[1] and prevented nodemcu from being detected over USB(tty). I uninstalled those packages, But it might not be an option for visually impaired.

Installing every Arch/AUR package could break some hardware compatibility which we've taken for granted(Story link is not opening as of writing, So not sure whether this case has been covered in it).

[1] https://unix.stackexchange.com/questions/670636/unable-to-us...

Re: Installing Every Arch Package

#89

Post by nix23 »

Datagenerator wrote: post #66
nix23 wrote: post #43

Earlier quoted context omitted.

"Nice" former coworker...hope you found your way to freebsd anyway :)

Sure did, still in active production use mostly for the excellent ZFS integration hosting many PB's of research data.

Happy to hear that ;)

Re: Installing Every Arch Package

#90

Post by seanw444 »

brightball wrote: post #50
seanw444 wrote: post #48

Earlier quoted context omitted.

It's only a matter of time. Linux really only has a good malware track record due to lack of popularity.

It seems like the popularity on servers would increase the likelihood.

Yeah I'd think so too. I should clarify: lack of popularity as a desktop OS means less desktop/amateur viruses. I'd assume most server attacks are more targeted and curated.

It's basically unnecessary to run any sort of anti-malware program on Linux, because not enough people use it for writing viruses for it to be profitable. And because the people who use it as a desktop are generally more knowledgeable and safe with their habits.

Post reply on HN