Arch Linux disables AUR package adoption • Hacker News Board

Re: Arch Linux disables AUR package adoption

#61

Post by DDayMace » Fri, Jul 31, 2026, 6:33 PM UTC

sp0rk wrote: post #11

WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

> I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux? This has absolutely not ever been the case.

yup there is no honor among thieves unfortunately

Re: Arch Linux disables AUR package adoption

#62

Post by al_borland » Fri, Jul 31, 2026, 6:37 PM UTC

WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

> I can’t help but feel there used to be honor among hackers.

My assumption is these aren't so much hackers, as modern day script kiddies armed with LLMs and too much free time.

Re: Arch Linux disables AUR package adoption

#63

Post by akerl_ » Fri, Jul 31, 2026, 6:41 PM UTC

WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

I think you've accidentally lumped together "people who work in tech in / around the field of information security" and "criminals".

There have been a variety of cultural elements to people doing security research / hacking on their own systems / etc.

There has never been "honor" among criminals looking to use technology to steal money or steal things that can be converted to money.

Re: Arch Linux disables AUR package adoption

#64

Post by Matl » Fri, Jul 31, 2026, 6:41 PM UTC

Alive-in-2025 wrote: post #57

Matl wrote: post #35

Earlier quoted context omitted.

With regards to sandboxing etc. maybe. With regards to packages? Official repos support signing and usually rely on maintainers with proven track records. AUR was a honor system and since some people are total basement losers, you can't rely on that.

We have locks on our doors for a reason. Any software that allows updates and relies on the honor system of "someone else must have checked this" will get hacked. Every day there's yet another certificate or secret stealing infection that is in some random upstream dependency in your dev tools or shell scripts or whatever.

Yes, my point being this isn't some 'Desktop Linux security' hole. This was a known and intentional model of how the AUR operated for decades. Unfortunately it was bound to get exploited like this and so it did.

Re: Arch Linux disables AUR package adoption

#65

Post by bigstrat2003 » Fri, Jul 31, 2026, 6:42 PM UTC

dandersch wrote: post #10

I think Arch has to rethink what the AUR really is for in the age of AI. If users aren't supposed to trust anything from the AUR, then they will start to use LLMs to scan PKGBUILDs for them. But at that point, why not let the LLM loose directly on the upstream repo and build+install the package from source?

Nobody needs to rethink anything in "the age of AI". Stop trying to make everything about your favorite topic. If the tool can provide value then they'll use it, if not they won't.

Re: Arch Linux disables AUR package adoption

#66

Post by weinzierl » Fri, Jul 31, 2026, 6:43 PM UTC

The other favourite besides Arch is NixOS. How does it compare when it comes to supply chain security?

Re: Arch Linux disables AUR package adoption

#67

Post by dmitrygr » Fri, Jul 31, 2026, 6:56 PM UTC

sp0rk wrote: post #11

WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

> I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux? This has absolutely not ever been the case.

> This has absolutely not ever been the case.

I think it was. Eg: on most russian warez forums in the 2000s, it was a bannable offense to crack russian-authored software.

Re: Arch Linux disables AUR package adoption

#68

Post by Barrin92 » Fri, Jul 31, 2026, 6:58 PM UTC

zahlman wrote: post #18

charcircuit wrote: post #9

Earlier quoted context omitted.

Desktop Linux has always been a house of cards in regards to security. I agree it's amazing that it went on for so long, but this was inevitable.

More so than, say, Windows? Really? And no, "people using one Linux distro can opt in to possibly getting pwned by each other by making use of a third-party software depot" does not reflect upon the entirety of the Linux world.

>More so than, say, Windows? Really?

significantly so. Windows has a coherent story when it comes to permissions and access. Differentiated out access controls, least privilege, UAC, mandatory integrity control and all configured out of the box.

Without AppArmor or SElinux correctly configured, which it isn't on most desktop distributions in the linux world most of your apps can still read anything, there's little sandboxing. The NT Kernel was designed with an object model in mind so you always had the abilities to have rich descriptions and policies for whatever you're handling where all of that is bolted on unix systems after the fact.

Re: Arch Linux disables AUR package adoption

#69

Post by dlcarrier » Fri, Jul 31, 2026, 7:10 PM UTC

dandersch wrote: post #10

I think Arch has to rethink what the AUR really is for in the age of AI. If users aren't supposed to trust anything from the AUR, then they will start to use LLMs to scan PKGBUILDs for them. But at that point, why not let the LLM loose directly on the upstream repo and build+install the package from source?

The AUR is still a better option than using curl to freebase shell scripts straight from github, which is pretty much the go-to route for any LLM-generated guides.

See also, the -o- emoticon: https://youtu.be/M1si1y5lvkk&t=1902s

Re: Arch Linux disables AUR package adoption

#70

Post by ApolloFortyNine » Fri, Jul 31, 2026, 7:18 PM UTC

vlovich123 wrote: post #29

> The project had suspended new account registration in June. That followed a campaign in which an attacker or attackers created new accounts to adopt orphaned packages and push malicious updates to them that would install malware on user systems. AUR registration was reopened on July 13 after the DevOps team added some minor, and apparently ineffective, restrictions on creating new accounts. Disabling AUR package ad…

>Disabling AUR package adoptions has been like the #1 thing recommended.

Do you have a solution to ever reenabling package adoptions? It's pretty much a must have feature for this to exist long term, at least in the AUR's current state where its a repo your not supposed to auto install from but pretty much all users do.

Really disabling adoptions is probably step 1 to just EOLing the whole thing.

The AUR by definition isn't to be trusted. That's what the official repos are for, you're supposed to read what the package install scripts are doing.