Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pushes to arch AUR are suspendended right now.

lists.archlinux.org

Post reply on HN
Print view View original

61–70 of 72 posts

Re: Pushes to arch AUR are suspendended right now.

#61

Post by numeri »

matheusmoreira wrote: post #50
numeri wrote: post #4

Well, I guess I'll avoid updating for the next few days. A bit worrisome that I did so last night. I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over. LLMs make large scale and long-term attacks easy and cheap. You cou…

> I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Can't have it both ways. Your packages can come from a small number of trusted individuals who maintain the software distribution. Naturally, this limits your choices to the packages they personally maintain. If you need something outside of that set, you need to ask them to include it or sour…

I agree one hundred percent! Doesn't mean I can't wish I could have it both ways :)

Re: Pushes to arch AUR are suspendended right now.

#62

Post by lenerdenator »

plastic-enjoyer wrote: post #45
lenerdenator wrote: post #11

Sadly, this is the future of a lot of FLOSS development unless people start to see their projects as their legacy instead of a simple hobby or a way to scratch an itch. Once your project obtains any sort of real notoriety, it starts having a blast radius, and you need to have at least some idea of who is pushing what to it when and why. The Linux kernel has a pretty good system of this for the time being with Linus b…

lmao, no. start paying people for FLOSS development, and maybe then we can talk about holding them accountable for their projects. as long as there are no contracts and no payment, there’s no point in making demands of these people.

Doing the boring paperwork to create a foundation or something similar is a step towards things like contracts and payment. Otherwise you're just a dude with a computer and how in the hell is my department supposed to pay you for services?

The existence of such organizational qualities should be something we look out for as software engineers when picking out dependencies for our projects.

Re: Pushes to arch AUR are suspendended right now.

#63

Post by lenerdenator »

matheusmoreira wrote: post #32
lenerdenator wrote: post #11

Sadly, this is the future of a lot of FLOSS development unless people start to see their projects as their legacy instead of a simple hobby or a way to scratch an itch. Once your project obtains any sort of real notoriety, it starts having a blast radius, and you need to have at least some idea of who is pushing what to it when and why. The Linux kernel has a pretty good system of this for the time being with Linus b…

Linus gets paid to be a BDFL. Pay me enough and I too will sit down and benevolently dictate things all day long. Until then, the world will have to make do with the blast radius.

He gets paid because there's a foundation set up to direct resources around kernel development, including his compensation.

You can see the fiscal info around that foundation here [0]

I know it's boring paper bullsh*t but this is the sort of thing more people need to set up.

[0] https://projects.propublica.org/nonprofits/organizations/460...

Re: Pushes to arch AUR are suspendended right now.

#64

Post by embedding-shape »

ThePowerOfFuet wrote: post #56
embedding-shape wrote: post #8

Earlier quoted context omitted.

> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no com…

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? I personally know nobody on either the Fedora or KDE teams. So I shouldn't do my banking on my Fedora KDE box?

It'd have been hard for anyone else to make it clearer to other's, that you don't actually understand what the AUR is nor how PKGBUILDs work. I'm not saying people should review the code/source/binary itself, I'm saying that people do tend to look at the URL/domain at least once, a glance, before installing binaries.

Re: Pushes to arch AUR are suspendended right now.

#65

Post by matheusmoreira »

lenerdenator wrote: post #63
matheusmoreira wrote: post #32

Earlier quoted context omitted.

Linus gets paid to be a BDFL. Pay me enough and I too will sit down and benevolently dictate things all day long. Until then, the world will have to make do with the blast radius.

He gets paid because there's a foundation set up to direct resources around kernel development, including his compensation. You can see the fiscal info around that foundation here [0] I know it's boring paper bullsh*t but this is the sort of thing more people need to set up . [0] https://projects.propublica.org/nonprofits/organizations/460...

I'd love to set one up, but I don't think it's enough... That's not the whole story. I bet the actual fundraising is a full time job unto itself.

I joined the GitHub Sponsors thing and somwhow got a few sponsors, but it wasn't even close to "quit $DAYJOB and focus on free software" territory. Achieving success here would be a dream come true but even the biggest open source projects aren't making anywhere close to a good individual salary. As the biggest free software project ever, Linux is always the exception.

Re: Pushes to arch AUR are suspendended right now.

#66

Post by embedding-shape »

dijit wrote: post #51
embedding-shape wrote: post #20

Earlier quoted context omitted.

> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure. AUR is a very different thing from this, where essentially a…

Realistically, maintainers are strangers on the internet to me, and crucially, it is common to add unofficial repos, as well as use non-platform package managers like npm, cargo and pip. It’s all strangers stuff

Personally, "strangers under a banner of long-standing organization XYZ" is different to me than "jkb_25342" on GitHub with one repository, with no source and only binary releases. Realistically, of course you're right, I don't know everyone who maintain the software I work, but I am familiar with the organization. Basically, you need to figure out where you can place your trust, which again for me personally, depends on a lot more things than "met face to face and know who they are".

Re: Pushes to arch AUR are suspendended right now.

#67

Post by kalenx »

embedding-shape wrote: post #41
cyberclimb wrote: post #39

Earlier quoted context omitted.

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access... Realistically most users? It's already quite a technical barrier to run Arch Linux, and the knowledge to further know about/understand PKGBUILD can only comes with time and is yet another layer filtering people's ability to know how to even try to catch something malicious. N…

> doesn't have time to review the full diffs they're upgrading to. Again, why are people expecting that you need to review the entire thing? You don't have to, you have to look at the download source (a github organization or a domain name or a cdn bucket) and look at what dependencies/other junk it pulls in. Usually this is 3-5 lines at max, and usually only the binary/source is taken from github/server, the rest is…

Many packages are _way_ more complex than 3-5 lines to review. To take an example (perhaps a bit extreme, but realistic as many nVidia users _have_ to install it), check nvidia-580xx-dkms Every patch (which runs in kernel space) may of course contain backdoors, so you'd have to review them. Every install line in the PKGBUILD may be installing a malware. Of course it is _possible_ to review all of it, but clearly not simple, even for a fairly technical user.

Sure, if you assume that every attack would be as glaring as the ones we've seen before, that makes it easier. But think of an attack at the level of the xz one and virtually no one would catch it.

Re: Pushes to arch AUR are suspendended right now.

#68

Post by kalenx »

matheusmoreira wrote: post #42
cyberclimb wrote: post #39

Earlier quoted context omitted.

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access... Realistically most users? It's already quite a technical barrier to run Arch Linux, and the knowledge to further know about/understand PKGBUILD can only comes with time and is yet another layer filtering people's ability to know how to even try to catch something malicious. N…

> It's already quite a technical barrier to run Arch Linux People are supposed to clear that barrier by studying the Arch Wiki and other technical materials so that they understand what they are doing, why they are doing it, and the risks involved. When they install random software pushed by random people they know nothing about much less trust without even so much as a glance at the PKGBUILD, they're not overcoming…

Taking the same example as above, if you have any nVidia card pascal or older, you have no other choice than using AUR for your driver; it was literally advertised as such on the Arch Linux home page :

>Users with GTX 10xx series and older cards must switch to the legacy proprietary branch to maintain support: > Install nvidia-580xx-dkms from the AUR

And those are packages very difficult to thoroughly review. At some point, just saying "users have been warned, too bad" might hold from a _legal_ point of view, but I feel like it is deflecting the blame a bit too much.

Re: Pushes to arch AUR are suspendended right now.

#69

Post by hug »

meribold wrote: post #27

The explicit expectation with the AUR has always been that you can't blindly trust the PKGBUILD files. It's more like running an installer from a random website on Windows than it is to using official distro repositories. I think the wiki also always advised against using AUR helper tools that blur the lines between official repositories and the AUR.

The Arch wiki explicitly links to the AUR for lots of things, but the prime example is probably the NVIDIA page - https://wiki.archlinux.org/title/NVIDIA - this page is going to be massively viewed, and if you have Pascal or older architecture the suggested driver is from, you guessed it, the AUR.

Nowhere on this page does it suggest that the AUR is at all untrustworthy.

Re: Pushes to arch AUR are suspendended right now.

#70

Post by matheusmoreira »

kalenx wrote: post #68
matheusmoreira wrote: post #42

Earlier quoted context omitted.

> It's already quite a technical barrier to run Arch Linux People are supposed to clear that barrier by studying the Arch Wiki and other technical materials so that they understand what they are doing, why they are doing it, and the risks involved. When they install random software pushed by random people they know nothing about much less trust without even so much as a glance at the PKGBUILD, they're not overcoming…

Taking the same example as above, if you have any nVidia card pascal or older, you have no other choice than using AUR for your driver; it was literally advertised as such on the Arch Linux home page : >Users with GTX 10xx series and older cards must switch to the legacy proprietary branch to maintain support: > Install nvidia-580xx-dkms from the AUR And those are packages very difficult to thoroughly review. At some…

[dead]
Post reply on HN