Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

phoronix.com

Post reply on HN
Print view View original

111–120 of 227 posts

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#111

Post by clickety_clack »

blcknight wrote: post #74
embedding-shape wrote: post #2

As always a fair reminder to not install random 3rd party packages/libraries/applications without reviewing them, especially when there is zero vetting. Luckily this was constrained to AUR, which basically is a free-for-all package repository, with users being warned multiple times that it's vital to review anything before you install it, compared to the official repositories. `rua` and other similar CLIs make it rea…

"Review" them how? Read every single line of code before installing something? If it's a binary package, how do you do that? Make reproducible builds for everything you install? Move to from source distro? Putting this on users is not a tenable solution. There's room for common sense, but blaming the users for this is ridiculous

It’s free lines of code on the internet that you are going out of your way to run on your own machine.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#112

Post by zeta0134 »

naturalmovement wrote: post #101
yowo wrote: post #96

Earlier quoted context omitted.

This is like saying a user who clone a random git repo is not to blame and git-scm should do more to prevent cloning of malicious repos. If it is not official, it is your job to review, if you dont like it, use iOS instead of Arch Linux. If you crash your car, you are liable for the accident. If you aren't ready for that, take the bus. More power = more responsibility

Uh but this isn't random git repos these are packages available through the OS's repos. Why does the AUR even exist if not for malware distribution? It's an uncontrolled free-for-all disguised as a watering hole. If they can't do the most basic of housekeeping it should not exist full stop.

They *are* doing the basic housekeeping. What do you think this announcement is, if not exactly that? AUR is very clearly documented as user-submitted, and automatic installs from it are heavily discouraged by the maintainers for this reason. Malware aside, there is very little quality control, and a poorly made AUR has the potential to break the system pretty badly. (Though, in my experience, most of the useful AUR packages are trivial to remove if something goes wrong.)

The officially maintained repositories (which are part of a default installation) were not affected. Users need to go somewhat out of their way to use an AUR.

The definition files are all plain text and not especially complicated. It's not too difficult to glance at the file before doing an install to get a basic idea of what it's about to do, just like you should do when running a random shell script or cloning a random git repo. Indeed, most AURs are implemented by cloning an upstream git repo and configuring it so it can be built. The same basic threat model applies: Do you trust the install script? Do you trust the upstream URL whose code it is about to compile?

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#113

Post by embedding-shape »

naturalmovement wrote: post #102
kcyb wrote: post #84

Earlier quoted context omitted.

As an arch user, I would always skim the PKGBUILD file of AUR packages to see if they install the software they claim to install from official sources and if there's something obviously fishy.

The BSDs prevent this by never having allowed random jamokes to upload Makefiles into the ports system.

Yeah, I've prevented this locally too by never building such a platform in the first place, always the best solution!

Jokes aside and just in case, you do realize ports and AUR have two very different models? Ports is more similar to the official Arch repositories, which obviously doesn't suffer from the same problem, and AFAIK, there is no BSD-equivalent of AUR.

BSD is cool and useful for lots of reasons, but comparisons based on misunderstandings helps no one :)

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#114

Post by [deleted] »

naturalmovement wrote: post #107
Hackbraten wrote: post #103

Earlier quoted context omitted.

> these are packages PKGBUILDs are not packages. They’re (user-contributed) instructions on how to build packages. > available through the OS's repos. No. The AUR is a platform, similarly to NPM or PyPI, that allows users to upload PKGBUILDs. It is not part of “the OS’s repos,” and it says that loud and clear, multiple times, including on the front page.

[flagged]

[deleted]

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#115

Post by embedding-shape »

naturalmovement wrote: post #107
Hackbraten wrote: post #103

Earlier quoted context omitted.

> these are packages PKGBUILDs are not packages. They’re (user-contributed) instructions on how to build packages. > available through the OS's repos. No. The AUR is a platform, similarly to NPM or PyPI, that allows users to upload PKGBUILDs. It is not part of “the OS’s repos,” and it says that loud and clear, multiple times, including on the front page.

[flagged]

You seem to have a wild misconception of what the AUR actually is.

It'd be more like a public toilet anyone could urinate in, and you lick the floor right next to the toilet and then is surprised that it tastes like pee. Of course there is pee on the floor, anyone can pee there!

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#116

Post by embedding-shape »

exceptione wrote: post #110
Hackbraten wrote: post #106

Earlier quoted context omitted.

> And what if upstream is problematic? Then don’t install the package. It’s on you to decide whether you trust upstream or not. You’re free to use any scanner you want on the upstream sources if it makes you feel safer. (I’m currently working on a makepkg extension that allows just that.) The core and extra repos are curated, and every package maintainer is doing their due diligence (and more) to protect the users. B…

> doing their due diligence (and more) Do you know how? This sounds like an unpractical high amount of time consuming task.

It really isn't, made a short tutorial just for you (and other's): https://news.ycombinator.com/item?id=48518704

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#117

Post by neoCrimeLabs »

naturalmovement wrote: post #107
Hackbraten wrote: post #103

Earlier quoted context omitted.

> these are packages PKGBUILDs are not packages. They’re (user-contributed) instructions on how to build packages. > available through the OS's repos. No. The AUR is a platform, similarly to NPM or PyPI, that allows users to upload PKGBUILDs. It is not part of “the OS’s repos,” and it says that loud and clear, multiple times, including on the front page.

[flagged]

Better analogy would blaming a supermarket that hosts an outdoor farmers market because you contracted food poisoning from a stand owned by someone else - NOT for buying food from within the supermarket itself.

Meanwhile one of the other customers has norovirus and is deliberately touching everything so others contract it.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#118

Post by gchamonlive »

blcknight wrote: post #74
embedding-shape wrote: post #2

As always a fair reminder to not install random 3rd party packages/libraries/applications without reviewing them, especially when there is zero vetting. Luckily this was constrained to AUR, which basically is a free-for-all package repository, with users being warned multiple times that it's vital to review anything before you install it, compared to the official repositories. `rua` and other similar CLIs make it rea…

"Review" them how? Read every single line of code before installing something? If it's a binary package, how do you do that? Make reproducible builds for everything you install? Move to from source distro? Putting this on users is not a tenable solution. There's room for common sense, but blaming the users for this is ridiculous

Ask an LLM to assess the package and do a web search for you. Nobody is installing tens of packages a day, you can take a few minutes to consider what you are installing. This isn't blaming the user, it's basic digital hygiene.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#119

Post by dualvariable »

-mlv wrote: post #75
embedding-shape wrote: post #2

As always a fair reminder to not install random 3rd party packages/libraries/applications without reviewing them, especially when there is zero vetting. Luckily this was constrained to AUR, which basically is a free-for-all package repository, with users being warned multiple times that it's vital to review anything before you install it, compared to the official repositories. `rua` and other similar CLIs make it rea…

I recall the AUR always being touted very highly as some great advantage for Arch as a linux distro, unfortunately this convenience has also come with a price. It's crazy that all it takes to become a maintainer of a package is to flag it as orphaned, wait 2 weeks for the original maintainer to fail to respond because they're on a holiday, and BAM! - the attacker can gets assigned as a maintainer and can now ship spi…

That is a terrible way to run a package repo in this day and age.

Maintainers need to have some level of vetting, and should own a repo or three for a while to establish a track record, before they get to blast out contributions to 100 of them without any review.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#120

Post by jolmg »

blcknight wrote: post #74
embedding-shape wrote: post #2

As always a fair reminder to not install random 3rd party packages/libraries/applications without reviewing them, especially when there is zero vetting. Luckily this was constrained to AUR, which basically is a free-for-all package repository, with users being warned multiple times that it's vital to review anything before you install it, compared to the official repositories. `rua` and other similar CLIs make it rea…

"Review" them how? Read every single line of code before installing something? If it's a binary package, how do you do that? Make reproducible builds for everything you install? Move to from source distro? Putting this on users is not a tenable solution. There's room for common sense, but blaming the users for this is ridiculous

> If it's a binary package, how do you do that?

You find one that builds from source, or you still review PKGBUILD and friends and lean more on evaluating the reputation of upstream and its maintainers, or you simply decide never to install binary packages. Your policy is yours to decide.

> Putting this on users is not a tenable solution.

The alternative would be to not have an AUR. Archlinux has official package repos where packages are vetted. The AUR (Arch User Repository) is not that. The AUR is there to provide greater variety of software than the official repos can, and it does that by not incurring the cost of being individually maintained by volunteer Arch staff and developers. It needs to not incur that cost for it to exist, otherwise it'd just be the official repos. It's like github, but limited to repos with PKGBUILDs.

Post reply on HN