Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pushes to arch AUR are suspendended right now.

lists.archlinux.org

Post reply on HN
Print view View original

41–50 of 72 posts

Re: Pushes to arch AUR are suspendended right now.

#41

Post by embedding-shape »

cyberclimb wrote: post #39
embedding-shape wrote: post #8

Earlier quoted context omitted.

> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no com…

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access... Realistically most users? It's already quite a technical barrier to run Arch Linux, and the knowledge to further know about/understand PKGBUILD can only comes with time and is yet another layer filtering people's ability to know how to even try to catch something malicious. N…

> doesn't have time to review the full diffs they're upgrading to.

Again, why are people expecting that you need to review the entire thing? You don't have to, you have to look at the download source (a github organization or a domain name or a cdn bucket) and look at what dependencies/other junk it pulls in. Usually this is 3-5 lines at max, and usually only the binary/source is taken from github/server, the rest is from official Arch repositories.

Of course it's unrealistic to expect users to review 100% of the code they run on their machine, that's why no one is expecting this, nor claiming that users should do this. But reviewing 3-5 lines when installing software from literal strangers on the internet, isn't so much to ask.

Re: Pushes to arch AUR are suspendended right now.

#42

Post by matheusmoreira »

cyberclimb wrote: post #39
embedding-shape wrote: post #8

Earlier quoted context omitted.

> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no com…

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access... Realistically most users? It's already quite a technical barrier to run Arch Linux, and the knowledge to further know about/understand PKGBUILD can only comes with time and is yet another layer filtering people's ability to know how to even try to catch something malicious. N…

> It's already quite a technical barrier to run Arch Linux

People are supposed to clear that barrier by studying the Arch Wiki and other technical materials so that they understand what they are doing, why they are doing it, and the risks involved.

When they install random software pushed by random people they know nothing about much less trust without even so much as a glance at the PKGBUILD, they're not overcoming any barriers, they're YOLOing their personal computers and hoping it turns out fine.

> I wouldn't blame the user.

I would. They were warned.

Re: Pushes to arch AUR are suspendended right now.

#43

Post by embedding-shape »

DavideNL wrote: post #29
embedding-shape wrote: post #20

Earlier quoted context omitted.

> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure. AUR is a very different thing from this, where essentially a…

I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…) The latter might be a problem caused by hosting it on the archlinux.org domain: it creates a *feeling* of trust, for the uninitiated.

> I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…)

Yup, 100%. Probably I've spent way too long time trying to make people (in the various AUR submissions here on HN) realize that the AUR probably isn't what they think it is, as most replies/comments about the AUR seems misinformed about what it is for and how it works.

Re: Pushes to arch AUR are suspendended right now.

#44

Post by embedding-shape »

dwedge wrote: post #30
nvme0n1p1 wrote: post #13

Earlier quoted context omitted.

Why especially upgrades? Upgrades are way easier to review than new installs. Most diffs I see are just these two lines: -pkgver=1.7.2 +pkgver=1.7.3 -sha256sums=('aaaaaaaaaa') +sha256sums=('bbbbbbbbbb') It takes like 5 seconds to read and press Y.

Call me naive (I don't use arch) but if that's the only change then what's the point releasing the change? Unless pkgver refers to an external dependency or a binary, in which case you might as well say reading the changelog counts as reading the code

Usually you concat them to form the GitHub tarball URL or similar, so on updates you only review the version/hash bumps, as on install you've validated the right GitHub organization/domain already.

Babashka has this for example (https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=babas...):

    pkgname=babashka-bin
    pkgver=1.13.219
    url='https://github.com/borkdude/babashka'
    source_x86_64=("${pkgname}-${pkgver}-linux-amd64-static.tar.gz::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-linux-amd64-static.tar.gz")
So on install, you review ideally everything, but at least the URL/organization/domain. Then on updates, you've already validated them, so the pkgver bump is the only thing of interest.

Re: Pushes to arch AUR are suspendended right now.

#45

Post by plastic-enjoyer »

lenerdenator wrote: post #11

Sadly, this is the future of a lot of FLOSS development unless people start to see their projects as their legacy instead of a simple hobby or a way to scratch an itch. Once your project obtains any sort of real notoriety, it starts having a blast radius, and you need to have at least some idea of who is pushing what to it when and why. The Linux kernel has a pretty good system of this for the time being with Linus b…

lmao, no. start paying people for FLOSS development, and maybe then we can talk about holding them accountable for their projects. as long as there are no contracts and no payment, there’s no point in making demands of these people.

Re: Pushes to arch AUR are suspendended right now.

#46

Post by OJFord »

dwedge wrote: post #30
nvme0n1p1 wrote: post #13

Earlier quoted context omitted.

Why especially upgrades? Upgrades are way easier to review than new installs. Most diffs I see are just these two lines: -pkgver=1.7.2 +pkgver=1.7.3 -sha256sums=('aaaaaaaaaa') +sha256sums=('bbbbbbbbbb') It takes like 5 seconds to read and press Y.

Call me naive (I don't use arch) but if that's the only change then what's the point releasing the change? Unless pkgver refers to an external dependency or a binary, in which case you might as well say reading the changelog counts as reading the code

AUR packages consist of packaging a third-party software (whether binary or source built as part of the package) for use on Arch.

Most updates are just bumping the upstream software version and its checksum, as GP describes, and yes arguably you should be reviewing the change to that software too, but that's a separate threat. And it may be a proprietary binary, in which case on update you've already decided to trust the third-party, so the diff shows you that nothing has changed in that regard, the trusted party simply released a new opaque version.

Re: Pushes to arch AUR are suspendended right now.

#47

Post by embedding-shape »

bondarchuk wrote: post #33
embedding-shape wrote: post #24

Earlier quoted context omitted.

Yes, indeed they might, but if you start seeing sketchy stuff like that, then don't continue, I'm not sure I understand what's hard here. Or do continue, but then if those are AUR packages themselves, review them as such. Personally I just ignore anything not built from official binaries/sources. If the PKGBUILD depends on more stuff then just officially available things, don't blindly install it and wish for the bes…

Ah but you switched now from "I don't think people do this" to "people shouldn't do this". You're right about the latter but wrong about the former.

Yes, contrary to popular belief, even I am affected by context and change what I converse about as the discussions topic and context drift, this is called having a conversation.

I'll stand by that I think most Arch Linux users, extrapolated from the people I know also run it, review at least the domain/GitHub organization for random AUR packages, and all of them are aware of what the AUR actually is, and is for.

I don't think most people here on HN who are clearly misunderstanding what the AUR is, are actually Arch users, or if they are, they haven't read the header that been visible since forever on the AUR.

Re: Pushes to arch AUR are suspendended right now.

#48

Post by preg_match »

embedding-shape wrote: post #8
dijit wrote: post #6

Earlier quoted context omitted.

> did you not even review the PKGBUILD or anything else before installing stuff from the AUR? I'd venture most people actually don't review pkgbuild; especially on upgrades . The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. You can even hide nefarious code in the compilation/build steps, Jia Tan…

> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no com…

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?

Well, for one almost everyone on Windows. That’s changing with winget and such but the standard Linux method is still an anomaly in desktop computing as a whole.

Re: Pushes to arch AUR are suspendended right now.

#49

Post by preg_match »

matheusmoreira wrote: post #40
embedding-shape wrote: post #28

Earlier quoted context omitted.

I can tell you misunderstand what the AUR actually is. It's not a package registry maintained by anyone, and it's also not limited to "build from source" or whatever. It's more like npm if anything, if you're familiar with that distribution mechanism.

> It's more like npm if anything, if you're familiar with that distribution mechanism. True, but I'd reverse the order. It's npm, pip, cargo, gem and all the others that are like the AUR. They're every bit as dangerous as the AUR, yet the AUR is the only one that singles itself out by warning people of the danger. Anyone can sign up and push packages. I've literally done that myself, even though nobody in the Arch Li…

Yes, and this is why npm is never installed on my hosts.

Folks podman is good. Very, very good. You want good developer ergonomics? Use dev containers. The cost of pulling npm packages Willy nilly on the host is not worth it!

Re: Pushes to arch AUR are suspendended right now.

#50

Post by matheusmoreira »

numeri wrote: post #4

Well, I guess I'll avoid updating for the next few days. A bit worrisome that I did so last night. I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over. LLMs make large scale and long-term attacks easy and cheap. You cou…

> I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem.

Can't have it both ways.

Your packages can come from a small number of trusted individuals who maintain the software distribution. Naturally, this limits your choices to the packages they personally maintain. If you need something outside of that set, you need to ask them to include it or source it yourself.

Alternatively, your packages can come from a software repository that allows internet randoms to push literally anything. That expands your selection to all software ever created, which includes malware since nobody's doing the work to filter that stuff out.

Arch Linux offers both paradigms. Make an informed decision.

Post reply on HN