Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pushes to arch AUR are suspendended right now.

lists.archlinux.org

Post reply on HN
Print view View original

21–30 of 72 posts

Re: Pushes to arch AUR are suspendended right now.

#21

Post by fantyoon »

embedding-shape wrote: post #17
fantyoon wrote: post #9

Earlier quoted context omitted.

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? I would assume essentially everyone? `curl https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from th…

What PKGBUILD referencing official sources that been attacked would not be easily visible? The second the source changes away from official sources, you stop installing from it. It's one line you have to review, usually pointing to either a Github release or a CDN/download host under the official domain.

PKGBUILDs are more powerful than that. They might download dependencies for the build from a package registry like npm, pypi, or crates, they might download and apply patches, and run arbitrary build scripts.

Changes to some of that might be easy to catch, but if the PKGBUILD depends on external resources, it can be quite hard to audit. I am not saying this is good practice, but you can see these sort of things happen all the time on the AUR.

Re: Pushes to arch AUR are suspendended right now.

#22

Post by matheusmoreira »

numeri wrote: post #4

Well, I guess I'll avoid updating for the next few days. A bit worrisome that I did so last night. I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over. LLMs make large scale and long-term attacks easy and cheap. You cou…

> the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over

The maintainers you're supposed to trust are Arch Linux's actual staff made up of package maintainers, formerly known as trusted users.

AUR packages are maintained by randoms on the internet. Anyone can sign up and push a package.

Re: Pushes to arch AUR are suspendended right now.

#23

Post by matheusmoreira »

fantyoon wrote: post #21
embedding-shape wrote: post #17

Earlier quoted context omitted.

What PKGBUILD referencing official sources that been attacked would not be easily visible? The second the source changes away from official sources, you stop installing from it. It's one line you have to review, usually pointing to either a Github release or a CDN/download host under the official domain.

PKGBUILDs are more powerful than that. They might download dependencies for the build from a package registry like npm, pypi, or crates, they might download and apply patches, and run arbitrary build scripts. Changes to some of that might be easy to catch, but if the PKGBUILD depends on external resources, it can be quite hard to audit. I am not saying this is good practice, but you can see these sort of things happe…

> dependencies for the build from a package registry like npm, pypi, or crates, it might download and apply patches, and run arbitrary build scripts

You're supposed to review every single one of those too.

Re: Pushes to arch AUR are suspendended right now.

#24

Post by embedding-shape »

fantyoon wrote: post #21
embedding-shape wrote: post #17

Earlier quoted context omitted.

What PKGBUILD referencing official sources that been attacked would not be easily visible? The second the source changes away from official sources, you stop installing from it. It's one line you have to review, usually pointing to either a Github release or a CDN/download host under the official domain.

PKGBUILDs are more powerful than that. They might download dependencies for the build from a package registry like npm, pypi, or crates, they might download and apply patches, and run arbitrary build scripts. Changes to some of that might be easy to catch, but if the PKGBUILD depends on external resources, it can be quite hard to audit. I am not saying this is good practice, but you can see these sort of things happe…

Yes, indeed they might, but if you start seeing sketchy stuff like that, then don't continue, I'm not sure I understand what's hard here. Or do continue, but then if those are AUR packages themselves, review them as such. Personally I just ignore anything not built from official binaries/sources.

If the PKGBUILD depends on more stuff then just officially available things, don't blindly install it and wish for the best. Just like if you "curl | bash" install something, you do at least look at the URL right? It takes a couple of seconds, maybe tens of seconds if you don't recognize the domain/github organization since before.

Re: Pushes to arch AUR are suspendended right now.

#25

Post by matheusmoreira »

unethical_ban wrote: post #12
embedding-shape wrote: post #8

Earlier quoted context omitted.

> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no com…

Me. Who reads the source code of every program they run? I've learned not to trust the AUR because the barrier to malice is lower, but I run system updates every other day.

> Who reads the source code of every program they run?

Me. It's even easier now with AI.

Re: Pushes to arch AUR are suspendended right now.

#26

Post by dwedge »

embedding-shape wrote: post #8
dijit wrote: post #6

Earlier quoted context omitted.

> did you not even review the PKGBUILD or anything else before installing stuff from the AUR? I'd venture most people actually don't review pkgbuild; especially on upgrades . The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. You can even hide nefarious code in the compilation/build steps, Jia Tan…

> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no com…

> No, I'm sorry but who on earth installs random software from random strangers

Everyone. People who don't tend to build from source and the convenience of package managers has outweighed this for most people for years now. Even if you review the code do you review every library it pulls in? Because I have to tell you I don't believe you, and if most people did do that then these supply chain attacks would be minor news.

Re: Pushes to arch AUR are suspendended right now.

#27

Post by meribold »

The explicit expectation with the AUR has always been that you can't blindly trust the PKGBUILD files. It's more like running an installer from a random website on Windows than it is to using official distro repositories. I think the wiki also always advised against using AUR helper tools that blur the lines between official repositories and the AUR.

Re: Pushes to arch AUR are suspendended right now.

#28

Post by embedding-shape »

dwedge wrote: post #26
embedding-shape wrote: post #8

Earlier quoted context omitted.

> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no com…

> No, I'm sorry but who on earth installs random software from random strangers Everyone. People who don't tend to build from source and the convenience of package managers has outweighed this for most people for years now. Even if you review the code do you review every library it pulls in? Because I have to tell you I don't believe you, and if most people did do that then these supply chain attacks would be minor n…

I can tell you misunderstand what the AUR actually is. It's not a package registry maintained by anyone, and it's also not limited to "build from source" or whatever. It's more like npm if anything, if you're familiar with that distribution mechanism.

Re: Pushes to arch AUR are suspendended right now.

#29

Post by DavideNL »

embedding-shape wrote: post #20
dijit wrote: post #10

Earlier quoted context omitted.

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. A decade of telling people that if they don't update constantly they're at risk, also affects us computer…

> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure. AUR is a very different thing from this, where essentially a…

I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…)

The latter might be a problem caused by hosting it on the archlinux.org domain: it creates a *feeling* of trust, for the uninitiated.

Re: Pushes to arch AUR are suspendended right now.

#30

Post by dwedge »

nvme0n1p1 wrote: post #13
dijit wrote: post #6

Earlier quoted context omitted.

> did you not even review the PKGBUILD or anything else before installing stuff from the AUR? I'd venture most people actually don't review pkgbuild; especially on upgrades . The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. You can even hide nefarious code in the compilation/build steps, Jia Tan…

Why especially upgrades? Upgrades are way easier to review than new installs. Most diffs I see are just these two lines: -pkgver=1.7.2 +pkgver=1.7.3 -sha256sums=('aaaaaaaaaa') +sha256sums=('bbbbbbbbbb') It takes like 5 seconds to read and press Y.

Call me naive (I don't use arch) but if that's the only change then what's the point releasing the change? Unless pkgver refers to an external dependency or a binary, in which case you might as well say reading the changelog counts as reading the code
Post reply on HN