Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux disables AUR package adoption

lwn.net

Post reply on HN
Print view View original

131–134 of 134 posts

Re: Arch Linux disables AUR package adoption

#131

Post by HDBaseT »

akdev1l wrote: post #100
christophilus wrote: post #83

Earlier quoted context omitted.

This just made me think: if Anthropic or OpenAI wanted to get some good will, and burn a bunch more investor funding, they'd provide security audits for the most popular N AUR packages for free as a good-will service.

This is a lose-lose proposition. 1. Lose money burning tokens in all of this stuff. 2. Lose reputation when some malware eventually makes it through

You could just as easily publish stats on the number of packages caught by the detection system though.

Re: Arch Linux disables AUR package adoption

#132

Post by tempfile »

charcircuit wrote: post #80
tempfile wrote: post #17

Earlier quoted context omitted.

What does "scanning for malware" mean? As far as I know this is a totally open question, and the only credible answers (install in a sandbox) are too inconvenient for widespread adoption.

>are too inconvenient for widespread adoption. The owners of AUR would do this for all packages they host so the inconvenience does not fall on other people. AUR has to take responsibility over the security of what they offer.

The inconvenience is always with the person writing the package. When you restrict the build to a sandbox, if it fails, it's because the package actually depends on the thing the sandbox is limiting (usually network requests during the build). To fix this problem, the package has to change. This is why e.g. NPM does not roll out sandboxing.

Re: Arch Linux disables AUR package adoption

#133

Post by Matl »

preg_match wrote: post #128
Alive-in-2025 wrote: post #57

Earlier quoted context omitted.

We have locks on our doors for a reason. Any software that allows updates and relies on the honor system of "someone else must have checked this" will get hacked. Every day there's yet another certificate or secret stealing infection that is in some random upstream dependency in your dev tools or shell scripts or whatever.

Yes but realistically trust is necessary, as users can’t audit all source code. The fact the source code is even audited is, in it of itself, a blessing. Google Play and the App Store don’t do that, and those are trust based systems as well. And naturally, malware slips through, as it always will.

The AUR is not like Google Play. Arch has https://archlinux.org/packages for that. The AUR is like an APK from a Reddit post.

Re: Arch Linux disables AUR package adoption

#134

Post by Ferret7446 »

tremon wrote: post #45
jolmg wrote: post #19

Earlier quoted context omitted.

> I'm sure there are legitimate uses of that functionality To avoid package name pollution, e.g. having package foo, foo-newpackage, foo-newpackage-updated, etc. each by a new maintainer as the priors get abandoned.

With a bit more structure, you could change that to: every package in AUR is actually registered as foo/maintainer under the hood, and installing the package without maintainer name pins it to the currently active version. Package adoption can then be formalized as a new maintainer publishing their own version of the package, and users of an already-installed package need to issue an explicit command to switch over t…

At that point just put it on github
Post reply on HN