Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux disables AUR package adoption

lwn.net

Post reply on HN
Print view View original

81–90 of 133 posts

Re: Arch Linux disables AUR package adoption

#81

Post by charcircuit »

zahlman wrote: post #18
charcircuit wrote: post #9

Earlier quoted context omitted.

Desktop Linux has always been a house of cards in regards to security. I agree it's amazing that it went on for so long, but this was inevitable.

More so than, say, Windows? Really? And no, "people using one Linux distro can opt in to possibly getting pwned by each other by making use of a third-party software depot" does not reflect upon the entirety of the Linux world.

I never claimed that and in fact Windows has had a lot of malware written for it proving it too has bad security.

There are more ways to attack people than third party software depos.

Re: Arch Linux disables AUR package adoption

#82

Post by charcircuit »

thayne wrote: post #76
davkan wrote: post #56

Earlier quoted context omitted.

I think the wrongful notion comes from the fact that the vast majority of Arch users use and speak about AUR as if it were a part of arch proper, only paying lip service to reviewing PKGBUILDS, etc. They wrap the default package manager in one that supports AUR and never touch it directly again. It feels closer to if all of GitHub was available in one click through the Microsoft store or windows update. And unfortuna…

Most AUR "helpers" show you the PKGBUILD and/or a diff thereof and ask you to confirm that it looks ok before continuing the install. At least by default. Maybe most users just ignore that and always answer yes without inspecting it. I don't know. But the wiki for the AUR and Readmes for many of these tools have warning banners telling you not to blindly trust AUR packages.

There are subtle things like abusing how github handles forks which can make malicious PKGBUILD a matter of just changing the rev with no hint in the file itself.

Re: Arch Linux disables AUR package adoption

#83

Post by christophilus »

vlovich123 wrote: post #29

> The project had suspended new account registration in June. That followed a campaign in which an attacker or attackers created new accounts to adopt orphaned packages and push malicious updates to them that would install malware on user systems. AUR registration was reopened on July 13 after the DevOps team added some minor, and apparently ineffective, restrictions on creating new accounts. Disabling AUR package ad…

This just made me think: if Anthropic or OpenAI wanted to get some good will, and burn a bunch more investor funding, they'd provide security audits for the most popular N AUR packages for free as a good-will service.

Re: Arch Linux disables AUR package adoption

#84

Post by ptx »

Pay08 wrote: post #77
tremon wrote: post #45

Earlier quoted context omitted.

With a bit more structure, you could change that to: every package in AUR is actually registered as foo/maintainer under the hood, and installing the package without maintainer name pins it to the currently active version. Package adoption can then be formalized as a new maintainer publishing their own version of the package, and users of an already-installed package need to issue an explicit command to switch over t…

Or, have actual user repos like a normal distro.

What do you mean? Their package manager allows you to add additional repositories, if that's what you want.

Re: Arch Linux disables AUR package adoption

#85

Post by yjftsjthsd-h »

gchamonlive wrote: post #6
OJFord wrote: post #3

Earlier quoted context omitted.

I've used it (not for abuse). It's simply volunteering to maintain the package after previous maintainer(s) have explicitly disowned it, knowing they no longer have time for it or don't care because they stopped using it, etc.

Problem is that there is no KYC process before someone can adopt any orphaned package

There's also no KYC process for creating one.

Re: Arch Linux disables AUR package adoption

#86

Post by yjftsjthsd-h »

Pay08 wrote: post #77
tremon wrote: post #45

Earlier quoted context omitted.

With a bit more structure, you could change that to: every package in AUR is actually registered as foo/maintainer under the hood, and installing the package without maintainer name pins it to the currently active version. Package adoption can then be formalized as a new maintainer publishing their own version of the package, and users of an already-installed package need to issue an explicit command to switch over t…

Or, have actual user repos like a normal distro.

How is that different?

Re: Arch Linux disables AUR package adoption

#87

Post by joha4270 »

Pay08 wrote: post #75
ApolloFortyNine wrote: post #70

Earlier quoted context omitted.

>Disabling AUR package adoptions has been like the #1 thing recommended. Do you have a solution to ever reenabling package adoptions? It's pretty much a must have feature for this to exist long term, at least in the AUR's current state where its a repo your not supposed to auto install from but pretty much all users do. Really disabling adoptions is probably step 1 to just EOLing the whole thing. The AUR by definitio…

> Really disabling adoptions is probably step 1 to just EOLing the whole thing. That's what they should do. The AUR has been a giant fuckup since the beginning, which is especially outrageous seeing as they had the perfect template for it with Gentoo's GURU.

What alternative do you then propose for "I'd like to install this random application which isn't popular/high quality enough to be included in the main repository"? Everyone figures it out from scratch by copy pasting bash commands from stackoverflow or maybe chatGPT these days?

Re: Arch Linux disables AUR package adoption

#90

Post by graemep »

saghm wrote: post #52
tempfile wrote: post #16

Earlier quoted context omitted.

I disagree. Maintainers for the major distributions take their roles very seriously, and do a very good job generally of filtering out malicious packages. The AUR is an outlier, being essentially an unmaintained wild west.

The AUR is also not really comparable to official distribution package repositories either. Yes, it's hosted by the same people as the official repos that are comparable to what you'd get by default on other Linux distros, but it's intentionally not something that works with official package management tooling. The equivalent would be if Debian or Ubuntu hosted a repo that anyone could upload of unbuilt debian packag…

The Ubuntu equivalent is PPAs.
Post reply on HN