Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

phoronix.com

Post reply on HN
Print view View original

161–170 of 227 posts

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#161

Post by homebrewer »

axus wrote: post #67
mcv wrote: post #55

Earlier quoted context omitted.

It's definitely a sign that popular packages should be moved from AUR to the official repository. I've got some stuff from AUR simply because it's something I need and that's where it is, and I never really verify it's safe; I just trust it blindly. Clearly a bad idea. I guess I should learn to avoid AUR and when I do use something from it, we more aware it's an exception and I need to check it more thoroughly. That'…

How much work is created (and for who) when a package is moved to the official repository?

A package maintainer has to be interested and willing to support it. Sometimes packages get dropped from the official repositories into AUR when the maintainer loses interest, and noone else wants to pick up the slack.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#162

Post by galleywest200 »

shlip wrote: post #157
mkayokay wrote: post #31

So from a quick read, it seems it installed "atomic-lockfile", "js-digest" or "lockfile-js" from npm. A list of affected packages is here [1]. Didn't find any quick info on how to check a system, so I ran the following command to find foreign packages and some date related infos: > pacman -Qmi Check the output against the list of affected packages. Then, you can also grep for those files in various locations: > grep…

Here is how I did it : Get a list of installed packages originating from AUR using 'yay' : yay -Qam > packages_aur.last Get list from https://md.archlinux.org/s/SxbqukK6IA# : curl https://md.archlinux.org/s/SxbqukK6IA/download > compromised.txt then : grep -wFf compromised.txt packages_aur.last should spit out the packages that are in both files, hence were compromised at some point, I guess.

Thank you for this! I only had two on my system, thank goodness. I have uninstalled both.

libgdata 0.18.1-5 qt5-3d 5.15.18-1

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#163

Post by qudat »

anthonj wrote: post #5

I cringed hard when some people started to make pacman wrappers that could install from AUR directly. I've installed stuff from the aur before but most of the times I prefer to skip the middleman and just navigate to the project website. A premade pkgbuild is not convenient enough to take the risk of typoquatting or the tactical npm or pip dependency.

I don’t bother with wrappers, why does it need to be easier than git clone + makepkg -i?

Then I just update when I need to update

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#164

Post by bilkow »

galleywest200 wrote: post #162
shlip wrote: post #157

Earlier quoted context omitted.

Here is how I did it : Get a list of installed packages originating from AUR using 'yay' : yay -Qam > packages_aur.last Get list from https://md.archlinux.org/s/SxbqukK6IA# : curl https://md.archlinux.org/s/SxbqukK6IA/download > compromised.txt then : grep -wFf compromised.txt packages_aur.last should spit out the packages that are in both files, hence were compromised at some point, I guess.

Thank you for this! I only had two on my system, thank goodness. I have uninstalled both. libgdata 0.18.1-5 qt5-3d 5.15.18-1

Have you checked the install date? I'm not sure which are the compromised version numbers, but if they were installed before June 10 you're probably safe. (I think libgdata 0.18.1-5 used to be on the main repos in February, and has recently been downgraded to AUR, so you may be fine).

Only packages from AUR have been compromised, meaning a normal update `pacman -Syu` won't install them, they'll only be installed by `makepkg` or AUR helpers (such as `paru`, which asks you to review the PKGBUILD diff).

Also, if you had installed a compromised version, uninstalling the packages is not enough, you'd probably need to reinstall your system and rotate all credentials. More info here and on the linked blog: https://discourse.ifin.network/t/400-aur-packages-compromise...

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#165

Post by homebrewer »

badgersnake wrote: post #158
yowo wrote: post #96

Earlier quoted context omitted.

This is like saying a user who clone a random git repo is not to blame and git-scm should do more to prevent cloning of malicious repos. If it is not official, it is your job to review, if you dont like it, use iOS instead of Arch Linux. If you crash your car, you are liable for the accident. If you aren't ready for that, take the bus. More power = more responsibility

> If you crash your car, you are liable for the accident. Because I didn’t go through all the blueprints and find the flaw that led to the crash. This is a dumb argument. It’s also the one the AUR appears to be making.

No, it's completely valid. The arch home page warns you that you're the one responsible for your system, and get to keep both pieces when something breaks. Everything is assembled with this philosophy in mind. This message is reinforced ten times more before the system is even installed and is up and running.

If this is not for you, that's fine, but it's been working very well for some of us for... decades, at this point? I'm not amused by the amount of people here wanting to turn arch into another Ubuntu, most of them having zero familiarity with how the AUR works, or arch more generally.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#166

Post by Barrin92 »

homebrewer wrote: post #165
badgersnake wrote: post #158

Earlier quoted context omitted.

> If you crash your car, you are liable for the accident. Because I didn’t go through all the blueprints and find the flaw that led to the crash. This is a dumb argument. It’s also the one the AUR appears to be making.

No, it's completely valid. The arch home page warns you that you're the one responsible for your system, and get to keep both pieces when something breaks. Everything is assembled with this philosophy in mind. This message is reinforced ten times more before the system is even installed and is up and running. If this is not for you, that's fine, but it's been working very well for some of us for... decades, at this p…

>but it's been working very well for some of us for... decades, at this point?

but it's worth asking why it's been working well. Has it been working well simply because it's been a niche ecosystem, or even because you wouldn't have known if it didn't because nobody did security audits?

The Arch distribution model, which operates like the Javascript ecosystem, as in having a barebones core and then a zoo of unregulated third party community packages does not seem fine these days. As it became more popular it has naturally drawn attention and from that moment on you're just screwed because you have no security infrastructure. Arch pretty much lived off security through obscurity.

And in particular with the popularity of these spin offs, I forgot what the name of the tiling wm thing is that got very popular, I think a lot of users are not aware that they're doing the software equivalent of buying medicine off craigslist

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#167

Post by ianburrell »

jl6 wrote: post #43
28304283409234 wrote: post #37

Could we be heading towards a world where it's just more secure to write inhouse software again, only now with AI agents? Not closed source per se, but 'own source'?

The endgame is to generate a binary image for an entire single-purpose OS/unikernel that does exactly and only what you require of it. No source to open or close.

The build process is just as vulnerable.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#168

Post by jl6 »

ianburrell wrote: post #167
jl6 wrote: post #43

Earlier quoted context omitted.

The endgame is to generate a binary image for an entire single-purpose OS/unikernel that does exactly and only what you require of it. No source to open or close.

The build process is just as vulnerable.

Sounds more midgame.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#169

Post by scarlehoff »

I like the aur wrappers for the convenience, but if I've already limited my AUR consumption quite a bit, I think from now on all aur updates will be manual.

One thing programs like yay could do though is to tie the packages to the maintainer. If the maintainer changes, it should be treated as a completely separate package. Not a perfect solution, but could avoid a few automatic upgrades.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#170

Post by [deleted] »

anthonj wrote: post #18
Grombobulous wrote: post #8

Earlier quoted context omitted.

For me, this tradeoff isn’t worth it. I didn’t switch to Linux so that I can waste time going to websites and clicking “download” to update my programs like a Windows user. The pacman wrappers you mention are crazy, though.

I get it, but you only need to do that for the odd cases of packages not present in the official repo (not that common at all for me at least). Also if the software is downloaded in the form of a git repo, you only needed to checkout the new tag and rebuild, don't need your browser at all.

[deleted]
Post reply on HN