Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pushes to arch AUR are suspendended right now.

lists.archlinux.org

Post reply on HN
Print view View original

51–60 of 72 posts

Re: Pushes to arch AUR are suspendended right now.

#51

Post by dijit »

embedding-shape wrote: post #20
dijit wrote: post #10

Earlier quoted context omitted.

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. A decade of telling people that if they don't update constantly they're at risk, also affects us computer…

> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure. AUR is a very different thing from this, where essentially a…

Realistically, maintainers are strangers on the internet to me, and crucially, it is common to add unofficial repos, as well as use non-platform package managers like npm, cargo and pip.

It’s all strangers stuff

Re: Pushes to arch AUR are suspendended right now.

#52

Post by matheusmoreira »

dwedge wrote: post #31
matheusmoreira wrote: post #25

Earlier quoted context omitted.

> Who reads the source code of every program they run? Me. It's even easier now with AI.

So, you don't.

Have been reading source code for over 15 years now. I read the source code of a lot of software, just for curiosity's sake. I go out of my way to read the source code of random scripts I find laying about and that I want to run, and I do so before running them. PKGBUILDs are in that category, as are random scripts people throw on GitHub.

Only difference is now I ask AI models to read the source too. Chances of malware slipping by both myself and AI is lower than it slipping by either in isolation.

Re: Pushes to arch AUR are suspendended right now.

#53

Post by matheusmoreira »

preg_match wrote: post #49
matheusmoreira wrote: post #40

Earlier quoted context omitted.

> It's more like npm if anything, if you're familiar with that distribution mechanism. True, but I'd reverse the order. It's npm, pip, cargo, gem and all the others that are like the AUR. They're every bit as dangerous as the AUR, yet the AUR is the only one that singles itself out by warning people of the danger. Anyone can sign up and push packages. I've literally done that myself, even though nobody in the Arch Li…

Yes, and this is why npm is never installed on my hosts. Folks podman is good. Very, very good. You want good developer ergonomics? Use dev containers. The cost of pulling npm packages Willy nilly on the host is not worth it!

> podman

Potential malware will share a kernel with the host. One exploit and we're owned. Virtual machines are the better solution. Infinitely smaller attack surface. If they crack hardware hypervisors, it means the entire industry is in deep shit, not just us.

I went so far as to code up my own development virtual machine orchestration software. Now I'm making a custom Rust network stack for it.

Re: Pushes to arch AUR are suspendended right now.

#55

Post by embedding-shape »

preg_match wrote: post #48
embedding-shape wrote: post #8

Earlier quoted context omitted.

> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no com…

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? Well, for one almost everyone on Windows. That’s changing with winget and such but the standard Linux method is still an anomaly in desktop computing as a whole.

Those users do look at the domain/URL though, where they are getting it from. The way to do that when using AUR, which they are explicit about, is to review the download source from PKGBUILD, which would be the same as a Windows user looking at the addressbar when they download something.

I know it's hard to believe, but many users, even Windows ones, actually check if they're on the right website/in the right GitHub organization, before downloading binaries.

Re: Pushes to arch AUR are suspendended right now.

#56

Post by ThePowerOfFuet »

embedding-shape wrote: post #8
dijit wrote: post #6

Earlier quoted context omitted.

> did you not even review the PKGBUILD or anything else before installing stuff from the AUR? I'd venture most people actually don't review pkgbuild; especially on upgrades . The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. You can even hide nefarious code in the compilation/build steps, Jia Tan…

> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no com…

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?

I personally know nobody on either the Fedora or KDE teams. So I shouldn't do my banking on my Fedora KDE box?

Re: Pushes to arch AUR are suspendended right now.

#57

Post by unethical_ban »

embedding-shape wrote: post #19
unethical_ban wrote: post #12

Earlier quoted context omitted.

Me. Who reads the source code of every program they run? I've learned not to trust the AUR because the barrier to malice is lower, but I run system updates every other day.

> Me. Who reads the source code of every program they run? No one. Who codes their own operating systems before they launch a calculator on their own computer? No one as well. Why the irrelevant questions? They're all very different things. You literally have to review one line, that points to a remote URL somewhere, that's it. If it's wrong/sus, don't install it, you don't even have to review more than that.

Thank you for explaining, since in the year-plus of using Arch that has never been shown in a tutorial or in the OS itself. "paru " is all I've known, and the AUR wiki makes it sounds like 15 steps of compile from source.

Re: Pushes to arch AUR are suspendended right now.

#58

Post by nvme0n1p1 »

dwedge wrote: post #30
nvme0n1p1 wrote: post #13

Earlier quoted context omitted.

Why especially upgrades? Upgrades are way easier to review than new installs. Most diffs I see are just these two lines: -pkgver=1.7.2 +pkgver=1.7.3 -sha256sums=('aaaaaaaaaa') +sha256sums=('bbbbbbbbbb') It takes like 5 seconds to read and press Y.

Call me naive (I don't use arch) but if that's the only change then what's the point releasing the change? Unless pkgver refers to an external dependency or a binary, in which case you might as well say reading the changelog counts as reading the code

The version string is used to build an external URL.

You're right, I don't audit every line of code in new versions of Firefox/Chrome/etc. I chose to trust the download URL when I first installed that package. Then on updates, I can check at a glance that the script hasn't changed to point to another URL or in other suspicious ways.

There are two possible threats here: "random AUR user" and "Google". I'm protected from the former deciding to bundle malware, but not the latter.

Re: Pushes to arch AUR are suspendended right now.

#59

Post by inversepolymath »

0gs wrote: post #18
dijit wrote: post #14

Earlier quoted context omitted.

Cool theory, but the same reason I pull my shoes off by standing on my heel and pulling, despite it saving me no time (I will have to untie them anyway when I put them on again). Humans are short sighted, want to solve the situation immediately and will do the laziest thing possible to accomplish a given task.

pop each lace down one eyelet and you'll never have to untie them again if the heel is both sturdy and forgiving enough

yeah but then it doesn't feel 'right'

Re: Pushes to arch AUR are suspendended right now.

#60

Post by numeri »

embedding-shape wrote: post #5
numeri wrote: post #4

Well, I guess I'll avoid updating for the next few days. A bit worrisome that I did so last night. I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over. LLMs make large scale and long-term attacks easy and cheap. You cou…

> naively and gratefully trust in the armies of volunteer maintainers is over I'm almost scared to ask, did you not even review the PKGBUILD or anything else before installing stuff from the AUR? Nixpkgs has a completed different model compared to AUR, the changes that end up in nixpkgs are all reviewed by maintainers, while AUR is literally free-for-all "anyone can push anything at any time", I don't think you ever…

I review the PKGBUILD often, but not always. The majority of the time when I do, it amounts to seeing a URL change. If I actually do check the URL it points to, it's just to verify it's official/the actual repo or source I intended to trust.

I was honestly never very worried about the attack vectors that are visible in PKGBUILD. Historically, with the rather popular AUR packages I install, any attack would be noticed rather quickly, which limits would-be attackers to those who don't care who they hack and don't mind it being short-lived. The threats I was more worried about were those from more malicious/advanced sources that would attack more subtly upstream – but if I've already decided to download and run a precompiled binary from a repo, I've already decided to accept that risk.

In other words, in the past, I relied mainly on the goodness and vigilance of the community, only occasionally investing time to check myself on less mainstream packages or repos.

Was this ideal? No. Was it sufficiently responsible? As it was my own machine and my own data at risk, I believe so. And to be honest, I've not had a single problem in over a decade of doing so.

That's clearly got to change now, though.

Post reply on HN