31–40 of 72 posts
Earlier quoted context omitted.
Me. Who reads the source code of every program they run? I've learned not to trust the AUR because the barrier to malice is lower, but I run system updates every other day.
> Who reads the source code of every program they run? Me. It's even easier now with AI.
Sadly, this is the future of a lot of FLOSS development unless people start to see their projects as their legacy instead of a simple hobby or a way to scratch an itch. Once your project obtains any sort of real notoriety, it starts having a blast radius, and you need to have at least some idea of who is pushing what to it when and why. The Linux kernel has a pretty good system of this for the time being with Linus b…
Earlier quoted context omitted.
PKGBUILDs are more powerful than that. They might download dependencies for the build from a package registry like npm, pypi, or crates, they might download and apply patches, and run arbitrary build scripts. Changes to some of that might be easy to catch, but if the PKGBUILD depends on external resources, it can be quite hard to audit. I am not saying this is good practice, but you can see these sort of things happe…
Yes, indeed they might, but if you start seeing sketchy stuff like that, then don't continue, I'm not sure I understand what's hard here. Or do continue, but then if those are AUR packages themselves, review them as such. Personally I just ignore anything not built from official binaries/sources. If the PKGBUILD depends on more stuff then just officially available things, don't blindly install it and wish for the bes…
Earlier quoted context omitted.
> No, I'm sorry but who on earth installs random software from random strangers Everyone. People who don't tend to build from source and the convenience of package managers has outweighed this for most people for years now. Even if you review the code do you review every library it pulls in? Because I have to tell you I don't believe you, and if most people did do that then these supply chain attacks would be minor n…
I can tell you misunderstand what the AUR actually is. It's not a package registry maintained by anyone, and it's also not limited to "build from source" or whatever. It's more like npm if anything, if you're familiar with that distribution mechanism.
In my case I'm guilty of not checking brew updates (even from casks) on Mac, but I'm also guilty of only updating them every couple of months so it probably balances out.
Earlier quoted context omitted.
> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure. AUR is a very different thing from this, where essentially a…
I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…) The latter might be a problem caused by hosting it on the archlinux.org domain: it creates a *feeling* of trust, for the uninitiated.
Arch Linux is not for the uninitiated.
So another active attack? Does anyone have any other details?
Earlier quoted context omitted.
> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no com…
> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? I would assume essentially everyone? `curl https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from th…
Sure wish GitHub READMEs hadn't normalized this.
Earlier quoted context omitted.
> did you not even review the PKGBUILD or anything else before installing stuff from the AUR? I'd venture most people actually don't review pkgbuild; especially on upgrades . The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. You can even hide nefarious code in the compilation/build steps, Jia Tan…
> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no com…
Realistically most users?
It's already quite a technical barrier to run Arch Linux, and the knowledge to further know about/understand PKGBUILD can only comes with time and is yet another layer filtering people's ability to know how to even try to catch something malicious.
Now consider the layer of even experienced user that's in a bit of rush and doesn't have time to review the full diffs they're upgrading to.
Ralistically it's nearly statistically impossible that 100% of users would be able to all catch and block a given exploit themselves. A shared responsibility model of security [1] comes to mind, and while it's great for users to be active participants in their security, their action/awareness should be a last resort. I wouldn't blame the user.
[1] https://docs.cloud.google.com/architecture/framework/securit...
Earlier quoted context omitted.
> No, I'm sorry but who on earth installs random software from random strangers Everyone. People who don't tend to build from source and the convenience of package managers has outweighed this for most people for years now. Even if you review the code do you review every library it pulls in? Because I have to tell you I don't believe you, and if most people did do that then these supply chain attacks would be minor n…
I can tell you misunderstand what the AUR actually is. It's not a package registry maintained by anyone, and it's also not limited to "build from source" or whatever. It's more like npm if anything, if you're familiar with that distribution mechanism.
True, but I'd reverse the order. It's npm, pip, cargo, gem and all the others that are like the AUR. They're every bit as dangerous as the AUR, yet the AUR is the only one that singles itself out by warning people of the danger.
Anyone can sign up and push packages. I've literally done that myself, even though nobody in the Arch Linux community knows or trusts me. AUR is the only one where users are repeatedly made aware of this danger. All the others normalize and encourage importing random unvetted dependencies for the sake of developer convenience.