Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

lists.archlinux.org

Post reply on HN
Print view View original

101–110 of 142 posts

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#101

Post by ziml77 »

johnisgood wrote: post #79
ziml77 wrote: post #60

Earlier quoted context omitted.

But their differentiation is that to improve performance they compile all the packages with newer instruction sets as the target as well as enabling more optimizations like LTO. And some are even optimized with PGO.

I find it odd to call a specific Linux distribution blazingly fast. Gentoo with make.conf (/etc/portage/make.conf[1]) having "CFLAGS="-O3 -march=native -flto"" means that Gentoo, a Linux distribution, is performant? [1] It is not a good idea to build everything with LTO or PGO enabled because not all packages support LTO / PGO cleanly. Do it on the basis of per-package.

I've seen claims of decent speed improvements when using CachyOS, though I can't say I've ever hunted down solid confirmation. I'm a bit wary of the project because I would have to put a lot of trust in them since they're rebuilding everything themselves and could easily introduce malware somewhere in there. (But I've been scared of distros before only to have it pointed out to me that some very well respected people are involved, so I could be worrying for nothing here too)

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#102

Post by diggan »

LeoPanthera wrote: post #92
diggan wrote: post #75

Earlier quoted context omitted.

It links to https://en.wikipedia.org/wiki/Arch_Linux#Derivatives which indeed lacks any mention of CachyOS. Luckily, Wikipedia is free to register, and you can just edit pages you feel like could be better. Seems like you found the perfect first edit to make for yourself :)

I have a long Wikipedia history, but that is not the point. There already was a CachyOS page, and it was removed. Why bother contributing stuff that will just be deleted again?

Most moderated spaces remove content that doesn't fit the community, Wikipedia does take that to the extreme but I still prefer that than the opposite extreme.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#103

Post by akerl_ »

Shellban wrote: post #85
gpm wrote: post #73

Earlier quoted context omitted.

Uh... did you install these AUR packages? It seems quite unlikely you installed these on either a router or a steam deck... That said, if you did, yeah being hacked is scary and I feel for you.

As @lillylizard pointed out, it turns out that these are new packages, not comprised existing packages like I first thought. Still, the nature of the hack is a Remote Execution, as you pointed out elsewhere, meaning the hacker could pull my router password from the password manager, or grab my SSH keys and log into whatever machine is listed in the known_hosts, or just mess with my Ebay account and the credit card sa…

Sure, but only if you’d installed the affected AUR packages. Even if they were old packages, probably your SteamOS didn’t install them from the AUR.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#104

Post by akerl_ »

IlikeKitties wrote: post #65
johnisgood wrote: post #55

Earlier quoted context omitted.

yay is a package manager that has been made for AUR. yay is not the official package manager for Arch Linux, pacman is, and it does not support AUR. yay is not installed on Arch Linux by default, its official package manager, pacman, is. AUR is for unofficial 3rd party packages, i.e. "use at your own risk". It has always been the case.

Yes, it is "use at your own risk" but most arch users just install from it without giving it a second thought, because availability of packages in the AUR is the one thing Arch is good at.

Those users are going to learn some hard lessons, either in this incident or a future one.

Archlinux is a distro that’s designed for the user to control their own system, and the AUR is clear about what it is and the nature of the packages in it.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#105

Post by akerl_ »

bee_rider wrote: post #78
nilamo wrote: post #41

Earlier quoted context omitted.

Plenty of package managers (such as `yay`) install from AUR by default.

On one hand, the distro developers can’t really prevent people from, say, hitting their computers with a sledgehammer or something. So to some extent, the users have to be trusted. But, maybe it would be best not to have “yay” available. Using something like AUR without reading the package build files is… pretty bad, right? And it is bad for the community, because if there is a convention of doing that sort of thing,…

Yay is a 3rd party package manager. The 1st party package manager does not interact with the AUR.

Yay itself is in the AUR. You have to go out of your way to install it.

The Archlinux docs on AUR helpers lead with a red warning: https://wiki.archlinux.org/title/AUR_helpers

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#106

Post by BearOso »

akerl_ wrote: post #77
johnisgood wrote: post #66

Earlier quoted context omitted.

No, it is NOT accurate. Pacman cannot be used to download, compile, or install AUR packages. You need the PKGBUILD file and use "makepkg -si" at the very least. If you want AUR packages, you'd install a package manager (in this context referred to as AUR helper) like "yay" that supports both official and unofficial (i.e. AUR) packages. FWIW AUR helpers are not even official packages, not even "yay" which is a popular…

And even with 3rd party package managers like yay, the package manager is pulling the pkgbuild definition locally, running makepkg for you, and then installing that.

And yay warns you before anything happens and prompts you to review the PKGBUILD files and any patches for this very reason. So there are at least two "are you sure?" confirmations needed before even building anything.

This is a situation where you have to go out of your way and be naive to be affected. You simply can't protect the user from everything.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#107

Post by BearOso »

Barrin92 wrote: post #98
WD-42 wrote: post #95

Earlier quoted context omitted.

How exactly is Arch barebones? It basically ships with everything I need, more than most distros (Zed and Discord are good examples). I don't even need to use the AUR.

Just by taking a glance at the most popular packages ( https://aur.archlinux.org/packages ) Pretty much every browser that isn't Firefox including Chrome, VS Code, most proprietary software like Slack, Zoom, Spotify, many vpn clients and password managers, a lot of them seemingly not published by the companies in question. All of those ancillary password, vpn or security related products who aren't going to be in the…

Chrome is in the main repos as chromium. VS Code is the "code" package. I don't know what vpn clients you're referring to, but networkmanager is built-in and has support for openvpn and wireguard.

Yes, proprietary software has to be installed separately, but for things like cloud password managers you're already putting your trust someplace else. You're also not likely to be hit by out of these flyby attacks, because the stuff people want is popular and has people watching it constantly and reputable people maintaining it. These patch/fix packages are suspicious looking and probably didn't have a single person touch them.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#108

Post by [deleted] »

BearOso wrote: post #106
akerl_ wrote: post #77

Earlier quoted context omitted.

And even with 3rd party package managers like yay, the package manager is pulling the pkgbuild definition locally, running makepkg for you, and then installing that.

And yay warns you before anything happens and prompts you to review the PKGBUILD files and any patches for this very reason. So there are at least two "are you sure?" confirmations needed before even building anything. This is a situation where you have to go out of your way and be naive to be affected. You simply can't protect the user from everything.

[deleted]

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#109

Post by [deleted] »

johnisgood wrote: post #55
nilamo wrote: post #41

Earlier quoted context omitted.

Plenty of package managers (such as `yay`) install from AUR by default.

yay is a package manager that has been made for AUR. yay is not the official package manager for Arch Linux, pacman is, and it does not support AUR. yay is not installed on Arch Linux by default, its official package manager, pacman, is. AUR is for unofficial 3rd party packages, i.e. "use at your own risk". It has always been the case.

[deleted]

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#110

Post by johnisgood »

IlikeKitties wrote: post #65
johnisgood wrote: post #55

Earlier quoted context omitted.

yay is a package manager that has been made for AUR. yay is not the official package manager for Arch Linux, pacman is, and it does not support AUR. yay is not installed on Arch Linux by default, its official package manager, pacman, is. AUR is for unofficial 3rd party packages, i.e. "use at your own risk". It has always been the case.

Yes, it is "use at your own risk" but most arch users just install from it without giving it a second thought, because availability of packages in the AUR is the one thing Arch is good at.

Oh, and by the way, not sure how people miss these:

> Warning: AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

This is from https://wiki.archlinux.org/title/Arch_User_Repository.

> Warning: AUR helpers are not supported by Arch Linux. You should become familiar with the manual build process in order to be prepared to troubleshoot problems.

This is from https://wiki.archlinux.org/title/AUR_helpers.

"yay" is one of the most common AUR helpers, it requires two confirmations from what I counted. One of them is to inspect the PKGBUILD file, the other one is just to proceed.

Post reply on HN