Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux disables AUR package adoption

lwn.net

Post reply on HN
Print view View original

111–120 of 134 posts

Re: Arch Linux disables AUR package adoption

#111

Post by matheusmoreira »

WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

People are warned countless times that the AUR is unsafe, that any random person can make an account and push packages, that you need to audit what you're downloading and that malware has been discovered in it multiple times in the past.

Re: Arch Linux disables AUR package adoption

#112

Post by Gud »

The problem is that there is a LOT of missing stuff in the Arch repos.

I use FresBSD, where I rarely run in to this problem, that something is missing from ports.

However, it is a common occurrence in Arch. Which is a shame, because it’s otherwise a fine operating system.

Re: Arch Linux disables AUR package adoption

#113

Post by Pay08 »

jolmg wrote: post #110
Pay08 wrote: post #77

Earlier quoted context omitted.

Or, have actual user repos like a normal distro.

They do. There's a list of them on the Arch Wiki: https://wiki.archlinux.org/title/Unofficial_user_repositorie... The problem with user repos vs the AUR is that you're trusting the maintainer behind them instead of inspecting the PKGBUILD and fetched sources yourself.

And they're incredibly unpopular.

The entire problem is that people weren't inspecting PKGBUILDs. At least with user repositories, you have someone who can build a reputation for trustworthy packages. There's a reason why every other distro does user repos.

Re: Arch Linux disables AUR package adoption

#114

Post by Pay08 »

alightsoul wrote: post #95
joha4270 wrote: post #87

Earlier quoted context omitted.

What alternative do you then propose for "I'd like to install this random application which isn't popular/high quality enough to be included in the main repository"? Everyone figures it out from scratch by copy pasting bash commands from stackoverflow or maybe chatGPT these days?

Or they just install it via random bash scripts on GitHub but that's just pushing the problem into the user.

It's been a while since I've seen software that provides an INSTALL.sh.

Re: Arch Linux disables AUR package adoption

#115

Post by inigyou »

dima55 wrote: post #104
dmitrygr wrote: post #67

Earlier quoted context omitted.

> This has absolutely not ever been the case. I think it was. Eg: on most russian warez forums in the 2000s, it was a bannable offense to crack russian-authored software.

[flagged]

Also the russian government doesn't punish cybercrime if the victim isn't russian.

Re: Arch Linux disables AUR package adoption

#116

Post by inigyou »

TiredOfLife wrote: post #107
fooqux wrote: post #105

Earlier quoted context omitted.

I doubt that anybody who is "not that technical" is going to install an AUR package on their steam deck.

All it requires is pasting stuff into terminal. And there are countless guides and videos

So they will disable curl|sh as well?

Re: Arch Linux disables AUR package adoption

#117

Post by inigyou »

cookiengineer wrote: post #71
WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

> What kind of jerk would attack Arch Linux? The answer is: Russians Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely. Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware. [1] https://github.com/cookiengineer/antimiasma [2] https://cookie.engineer/projects/cyber-defense/antimiasma.ht...

This is also very common with malware groups that want you to think they are Russian.

Re: Arch Linux disables AUR package adoption

#118

Post by inigyou »

tmtvl wrote: post #101
cookiengineer wrote: post #71

Earlier quoted context omitted.

> What kind of jerk would attack Arch Linux? The answer is: Russians Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely. Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware. [1] https://github.com/cookiengineer/antimiasma [2] https://cookie.engineer/projects/cyber-defense/antimiasma.ht...

Only ru_RU? It doesn't get disabled with, say, zh_CN, ko_KR, or anything else where the script is outside of the Basic Multilingual Plane (AKA ASCII)?

> the Basic Multilingual Plane (AKA ASCII)

Incorrect. ASCII is 0000-007F and the BMP is 0000-FFFF

Re: Arch Linux disables AUR package adoption

#119

Post by [deleted] »

Pay08 wrote: post #113
jolmg wrote: post #110

Earlier quoted context omitted.

They do. There's a list of them on the Arch Wiki: https://wiki.archlinux.org/title/Unofficial_user_repositorie... The problem with user repos vs the AUR is that you're trusting the maintainer behind them instead of inspecting the PKGBUILD and fetched sources yourself.

And they're incredibly unpopular. The entire problem is that people weren't inspecting PKGBUILDs. At least with user repositories, you have someone who can build a reputation for trustworthy packages. There's a reason why every other distro does user repos.

[deleted]

Re: Arch Linux disables AUR package adoption

#120

Post by inigyou »

simonask wrote: post #44

The older I get, the more critical I become of the culture of anonymity in OSS. The obvious-but-hard solution to this, as well as certain other attacks like the xz incident, is a chain of trust. Every line of code in every package should be cryptographically attributable to an individual or an organization, ideally associated with a government-issued ID. Git commits without a real name and a cryptographic signature s…

What culture of anonymity? OSS has traditionally been done in public with full names attached to everything. Sometimes it's a legal entity instead of a set of individuals.
Post reply on HN