Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux AUR Hit by Another Wave of Now More Sophisticated Malware Attack

phoronix.com

Post reply on HN
Print view View original

11–20 of 30 posts

Re: Arch Linux AUR Hit by Another Wave of Now More Sophisticated Malware Attack

#11

Post by helterskelter »

This is why I avoid AUR, it's too easy to become complacent. If I really want something from AUR I literally just look at the PKGBUILD for compilation instructions and do it manually by myself, but if it's got so many patches or dependencies that I can't go through them all by hand I just find another solution or do without.

This is also why I really dislike a lot of modern languages with automated fetching of dependencies. It really fosters a sloppy attitude toward your supply chain because it's just too damned convenient. With a reasonably sized Go project for instance, you may be pulling in code from dozens of different git repos. It only takes one compromised repo or malicious package to sink the ship.

Re: Arch Linux AUR Hit by Another Wave of Now More Sophisticated Malware Attack

#13

Post by NekkoDroid »

helterskelter wrote: post #11

This is why I avoid AUR, it's too easy to become complacent. If I really want something from AUR I literally just look at the PKGBUILD for compilation instructions and do it manually by myself, but if it's got so many patches or dependencies that I can't go through them all by hand I just find another solution or do without. This is also why I really dislike a lot of modern languages with automated fetching of depend…

Not even that, AUR packages are just git repos, they don't auto update unless you use an AUR helper that does. You literally can just clone it and makepkg it and then pacman also tracks the installed files and uninstalling is a breeze.

Re: Arch Linux AUR Hit by Another Wave of Now More Sophisticated Malware Attack

#14

Post by bfrog »

I’m moving all my machines to NixOS. I’d done this before but ran into time constraints creating ports for convoluted binary software. With LLMs now as good as they are it’s quite possible this isn’t a problem anymore. I’ll be finding out.

Re: Arch Linux AUR Hit by Another Wave of Now More Sophisticated Malware Attack

#15

Post by senectus1 »

7e wrote: post #2

Companies like Anthropic and OpenAI need to sponsor open source projects by giving them free agent credits. Otherwise, bad actors can just outspend and totally overwhelm the somewhat dim and very overworked set of human maintainers. Humans in software are obsolete, full stop.

lol

They're already running at a significant loss. giving out more free stuff isnt going to help.

What they really need to do is charge what it actually costs them. That will slow down the abuse a little.

Re: Arch Linux AUR Hit by Another Wave of Now More Sophisticated Malware Attack

#17

Post by Krutonium »

thewebguyd wrote: post #9
micaeked wrote: post #3

Earlier quoted context omitted.

Both already do that. The AUR stuff is more of a policy issue and unmatched expectations, unrelated to llms imo

> The AUR stuff is more of a policy issue Yes. This has happened before, a few times, before LLMs were even a thing. Via the same mechanism as well (someone else adopting an orphaned package). The big one I'm remembering was in 2018. Outside of that mechanism though, anyone who uses the AUR regularly knowingly accepts this kind of risk. It's why I'm not a huge fan of distros (like Cachy, Endevaor, etc) that take Arch…

For what it's worth with regard to the Chaotic AUR, there's claims I've seen that they do vet packages updates going into it before they're actually built.

Re: Arch Linux AUR Hit by Another Wave of Now More Sophisticated Malware Attack

#18

Post by Krutonium »

senectus1 wrote: post #15
7e wrote: post #2

Companies like Anthropic and OpenAI need to sponsor open source projects by giving them free agent credits. Otherwise, bad actors can just outspend and totally overwhelm the somewhat dim and very overworked set of human maintainers. Humans in software are obsolete, full stop.

lol They're already running at a significant loss. giving out more free stuff isnt going to help. What they really need to do is charge what it actually costs them. That will slow down the abuse a little.

That will also make it entirely unfeasible for anyone to use their services. The cost of the tokens you could burn on a $200 plan is in the neighborhood of $1200. They're getting users now and gambling on the cost of compute (or the difficulty of compute) dropping precipitously before they run out of cash.

Re: Arch Linux AUR Hit by Another Wave of Now More Sophisticated Malware Attack

#20

Post by DavideNL »

Since Arch is hosting / facilitating the AUR on the archlinux.org domain, i think this causes less technical users to assume some level of trust. Even when they are aware that these are 3rd party packages.

Also i find it surprising that there's only very little/slow communication from Arch via their news channel. For example, how users can check for infections.

Post reply on HN