Arch Linux disables AUR package adoption • Hacker News Board

Re: Arch Linux disables AUR package adoption

#101

Post by tmtvl » Sat, Aug 01, 2026, 1:02 AM UTC

cookiengineer wrote: post #71

WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

> What kind of jerk would attack Arch Linux? The answer is: Russians Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely. Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware. [1] https://github.com/cookiengineer/antimiasma [2] https://cookie.engineer/projects/cyber-defense/antimiasma.ht...

Only ru_RU? It doesn't get disabled with, say, zh_CN, ko_KR, or anything else where the script is outside of the Basic Multilingual Plane (AKA ASCII)?

Re: Arch Linux disables AUR package adoption

#102

Post by Barrin92 » Sat, Aug 01, 2026, 1:26 AM UTC

charcircuit wrote: post #93

Barrin92 wrote: post #68

Earlier quoted context omitted.

>More so than, say, Windows? Really? significantly so. Windows has a coherent story when it comes to permissions and access. Differentiated out access controls, least privilege, UAC, mandatory integrity control and all configured out of the box. Without AppArmor or SElinux correctly configured, which it isn't on most desktop distributions in the linux world most of your apps can still read anything, there's little sa…

>Windows has a coherent story when it comes to permissions and access. Yet that doesn't seem to matter much for stealer malware.

it does matter, things like the Data Protection API do meaningfully reduce what you can extract from a windows system.

Of course Windows regardless has taken the brunt of the attacks because it ran virtually every desktop machine in the world so people go after users anyway. Desktop Linux systems where never economically interesting for malware. But now that they have gained a modicum of traction they're going to get the exact same treatment, hence this thread.

Microsoft doesn't advertise it much but they do have the advantage of controlling their build environments, software is signed etc. A system like the AUR where you pull in unsigned packages from anonymous people with so many arch users relying on it is not going to be easy to address. It lived on security through obscurity.

Re: Arch Linux disables AUR package adoption

#103

Post by charcircuit » Sat, Aug 01, 2026, 1:42 AM UTC

Barrin92 wrote: post #102

charcircuit wrote: post #93

Earlier quoted context omitted.

>Windows has a coherent story when it comes to permissions and access. Yet that doesn't seem to matter much for stealer malware.

it does matter, things like the Data Protection API do meaningfully reduce what you can extract from a windows system. Of course Windows regardless has taken the brunt of the attacks because it ran virtually every desktop machine in the world so people go after users anyway. Desktop Linux systems where never economically interesting for malware. But now that they have gained a modicum of traction they're going to get…

>Data Protection API do meaningfully reduce what you can extract from a windows system

It's not meaningfully reduced. The stealer just has to call CryptUnprotectData before uploading it. It's not even like it will show a suspicious prompt to the user, without having to do anything extra the stealer can silently decrypt it.

I agree with the rest of the post though.

Re: Arch Linux disables AUR package adoption

#104

Post by dima55 » Sat, Aug 01, 2026, 2:56 AM UTC

dmitrygr wrote: post #67

sp0rk wrote: post #11

Earlier quoted context omitted.

> I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux? This has absolutely not ever been the case.

> This has absolutely not ever been the case. I think it was. Eg: on most russian warez forums in the 2000s, it was a bannable offense to crack russian-authored software.

[flagged]

Re: Arch Linux disables AUR package adoption

#105

Post by fooqux » Sat, Aug 01, 2026, 4:23 AM UTC

static_motion wrote: post #74

WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

The reason is popularity. SteamOS is Arch-based and in the hands of a ton of people who aren't necessarily that technical. CachyOS and EndeavourOS have become very popular with the increasing adoption of desktop Linux. The AUR thus becomes an enticing attack surface.

I doubt that anybody who is "not that technical" is going to install an AUR package on their steam deck.

Re: Arch Linux disables AUR package adoption

#106

Post by TiredOfLife » Sat, Aug 01, 2026, 4:51 AM UTC

dmitrygr wrote: post #67

sp0rk wrote: post #11

Earlier quoted context omitted.

> I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux? This has absolutely not ever been the case.

> This has absolutely not ever been the case. I think it was. Eg: on most russian warez forums in the 2000s, it was a bannable offense to crack russian-authored software.

That usually was because authors were also posters on that forum and offered significant discounts or even free licences

Re: Arch Linux disables AUR package adoption

#107

Post by TiredOfLife » Sat, Aug 01, 2026, 4:53 AM UTC

fooqux wrote: post #105

static_motion wrote: post #74

Earlier quoted context omitted.

The reason is popularity. SteamOS is Arch-based and in the hands of a ton of people who aren't necessarily that technical. CachyOS and EndeavourOS have become very popular with the increasing adoption of desktop Linux. The AUR thus becomes an enticing attack surface.

I doubt that anybody who is "not that technical" is going to install an AUR package on their steam deck.

All it requires is pasting stuff into terminal. And there are countless guides and videos

Re: Arch Linux disables AUR package adoption

#108

Post by TiredOfLife » Sat, Aug 01, 2026, 4:57 AM UTC

zahlman wrote: post #18

charcircuit wrote: post #9

Earlier quoted context omitted.

Desktop Linux has always been a house of cards in regards to security. I agree it's amazing that it went on for so long, but this was inevitable.

More so than, say, Windows? Really? And no, "people using one Linux distro can opt in to possibly getting pwned by each other by making use of a third-party software depot" does not reflect upon the entirety of the Linux world.

Yes. Windows has had a built in antivirus for 14 years

Re: Arch Linux disables AUR package adoption

#109

Post by pitaj » Sat, Aug 01, 2026, 5:46 AM UTC

joha4270 wrote: post #87

Pay08 wrote: post #75

Earlier quoted context omitted.

> Really disabling adoptions is probably step 1 to just EOLing the whole thing. That's what they should do. The AUR has been a giant fuckup since the beginning, which is especially outrageous seeing as they had the perfect template for it with Gentoo's GURU.

What alternative do you then propose for "I'd like to install this random application which isn't popular/high quality enough to be included in the main repository"? Everyone figures it out from scratch by copy pasting bash commands from stackoverflow or maybe chatGPT these days?

Namespace every package, so you install "somebody/thing" instead of just "thing"

Re: Arch Linux disables AUR package adoption

#110

Post by jolmg » Sat, Aug 01, 2026, 6:21 AM UTC

Pay08 wrote: post #77

tremon wrote: post #45

Earlier quoted context omitted.

With a bit more structure, you could change that to: every package in AUR is actually registered as foo/maintainer under the hood, and installing the package without maintainer name pins it to the currently active version. Package adoption can then be formalized as a new maintainer publishing their own version of the package, and users of an already-installed package need to issue an explicit command to switch over t…

Or, have actual user repos like a normal distro.

They do. There's a list of them on the Arch Wiki:

https://wiki.archlinux.org/title/Unofficial_user_repositorie...

The problem with user repos vs the AUR is that you're trusting the maintainer behind them instead of inspecting the PKGBUILD and fetched sources yourself.