Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux disables AUR package adoption

lwn.net

Post reply on HN
Print view View original

121–130 of 134 posts

Re: Arch Linux disables AUR package adoption

#121

Post by inigyou »

slowin wrote: post #49
simonask wrote: post #44

The older I get, the more critical I become of the culture of anonymity in OSS. The obvious-but-hard solution to this, as well as certain other attacks like the xz incident, is a chain of trust. Every line of code in every package should be cryptographically attributable to an individual or an organization, ideally associated with a government-issued ID. Git commits without a real name and a cryptographic signature s…

> What would we lose? You'd lose the ability to work on and distribute software not approved by your and various other governments. For example, if the UK makes BitTorrent illegal, what happens to you when you've attached your identity to your torrent client when you try to enter the UK (or already live there)? Security must be solved without removing anonymity.

For example, Bitchat is illegal in India right now, PGP is probably going to become illegal in the EU and UK, and Hypothetical Child Porn Organizer is probably illegal in most places. Tornado Cash is illegal everywhere the US has power, which is almost everywhere.

Re: Arch Linux disables AUR package adoption

#122

Post by saghm »

graemep wrote: post #90
saghm wrote: post #52

Earlier quoted context omitted.

The AUR is also not really comparable to official distribution package repositories either. Yes, it's hosted by the same people as the official repos that are comparable to what you'd get by default on other Linux distros, but it's intentionally not something that works with official package management tooling. The equivalent would be if Debian or Ubuntu hosted a repo that anyone could upload of unbuilt debian packag…

The Ubuntu equivalent is PPAs.

It's the closest thing, and what gets used in practice for the same purpose, but I'd argue it's not quite equivalent. The equivalent to PPAs in Arch would be putting a custom repository in `/etc/pacman.conf`, which is a thing that is done sometimes (e.g. on SteamOS to provide specific versions of certain software).

Re: Arch Linux disables AUR package adoption

#123

Post by inigyou »

inigyou wrote: post #121
slowin wrote: post #49

Earlier quoted context omitted.

> What would we lose? You'd lose the ability to work on and distribute software not approved by your and various other governments. For example, if the UK makes BitTorrent illegal, what happens to you when you've attached your identity to your torrent client when you try to enter the UK (or already live there)? Security must be solved without removing anonymity.

For example, Bitchat is illegal in India right now, PGP is probably going to become illegal in the EU and UK, and Hypothetical Child Porn Organizer is probably illegal in most places. Tornado Cash is illegal everywhere the US has power, which is almost everywhere.

or not so hypothetical. I did once stumble across an open source project to organise your child porn, hosted on GitHub! I don't remember what it was called.

Re: Arch Linux disables AUR package adoption

#124

Post by tmtvl »

inigyou wrote: post #118
tmtvl wrote: post #101

Earlier quoted context omitted.

Only ru_RU? It doesn't get disabled with, say, zh_CN, ko_KR, or anything else where the script is outside of the Basic Multilingual Plane (AKA ASCII)?

> the Basic Multilingual Plane (AKA ASCII) Incorrect. ASCII is 0000-007F and the BMP is 0000-FFFF

You're right, I'm wrong, my bad. Still I wonder if the software fails to work when paths contain unexpected characters.

Re: Arch Linux disables AUR package adoption

#125

Post by cookiengineer »

inigyou wrote: post #117
cookiengineer wrote: post #71

Earlier quoted context omitted.

> What kind of jerk would attack Arch Linux? The answer is: Russians Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely. Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware. [1] https://github.com/cookiengineer/antimiasma [2] https://cookie.engineer/projects/cyber-defense/antimiasma.ht...

This is also very common with malware groups that want you to think they are Russian.

The comment length is too small to write a thorough malware analysis.

That is why I linked my blogposts, the tool, and the whitepaper that I published about it. You have to read it first to come to your own conclusions.

If you come to conclusions without reading either of it, there's no point in arguing with you because you made up your mind anyways, and are not interested in learning about malware reversing :)

Re: Arch Linux disables AUR package adoption

#126

Post by LargoLasskhyfv »

davkan wrote: post #56
nvme0n1p1 wrote: post #23

Earlier quoted context omitted.

It's funny how these people say Linux security is bad because random people can upload arbitrary files to AUR, but won't say Windows security is bad because random people can upload arbitrary files to Microsoft GitHub.

I think the wrongful notion comes from the fact that the vast majority of Arch users use and speak about AUR as if it were a part of arch proper, only paying lip service to reviewing PKGBUILDS, etc. They wrap the default package manager in one that supports AUR and never touch it directly again. It feels closer to if all of GitHub was available in one click through the Microsoft store or windows update. And unfortuna…

There is much stuff which isn't in the AUR at all, or if so in versions similar to debian default, and/or orphaned.

Nonetheless, the full tray is just one yay away, which also speaks git.

How you use such tools is totally up to you.

So far I've been unaffected by the AUR hickups, running Cachy for about 2 years now.

But I've been always wary about the AUR, trying to minimize its use. Even in the phase where I used pure Arch for several years. It tends to get messy. So less AUR is less mess.

Re: Arch Linux disables AUR package adoption

#127

Post by OJFord »

yjftsjthsd-h wrote: post #85
gchamonlive wrote: post #6

Earlier quoted context omitted.

Problem is that there is no KYC process before someone can adopt any orphaned package

There's also no KYC process for creating one.

There is more risk in someone adopting something with established users though. Some people (cough) might be a bit less careful if they see something has tonnes of users, votes, comments; people actively using and liking the package.

Re: Arch Linux disables AUR package adoption

#128

Post by preg_match »

Alive-in-2025 wrote: post #57
Matl wrote: post #35

Earlier quoted context omitted.

With regards to sandboxing etc. maybe. With regards to packages? Official repos support signing and usually rely on maintainers with proven track records. AUR was a honor system and since some people are total basement losers, you can't rely on that.

We have locks on our doors for a reason. Any software that allows updates and relies on the honor system of "someone else must have checked this" will get hacked. Every day there's yet another certificate or secret stealing infection that is in some random upstream dependency in your dev tools or shell scripts or whatever.

Yes but realistically trust is necessary, as users can’t audit all source code. The fact the source code is even audited is, in it of itself, a blessing. Google Play and the App Store don’t do that, and those are trust based systems as well. And naturally, malware slips through, as it always will.

Re: Arch Linux disables AUR package adoption

#129

Post by preg_match »

Barrin92 wrote: post #68
zahlman wrote: post #18

Earlier quoted context omitted.

More so than, say, Windows? Really? And no, "people using one Linux distro can opt in to possibly getting pwned by each other by making use of a third-party software depot" does not reflect upon the entirety of the Linux world.

>More so than, say, Windows? Really? significantly so. Windows has a coherent story when it comes to permissions and access. Differentiated out access controls, least privilege, UAC, mandatory integrity control and all configured out of the box. Without AppArmor or SElinux correctly configured, which it isn't on most desktop distributions in the linux world most of your apps can still read anything, there's little sa…

I would say most Linux desktops users are aggressively sandboxing everything. All my dev envs are sandboxed, trivially, Claude is sandboxed, and all my apps are flatpak. And I do actually revoke permissions for flatpaks often, although most are real good about it - using xdg-directory and such.

Maybe I’m a minority, but the tools are very mature and easy to use IMO. In windows land people are still installing random EXEs, that’s the reality.

Re: Arch Linux disables AUR package adoption

#130

Post by [deleted] »

dmitrygr wrote: post #67
sp0rk wrote: post #11

Earlier quoted context omitted.

> I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux? This has absolutely not ever been the case.

> This has absolutely not ever been the case. I think it was. Eg: on most russian warez forums in the 2000s, it was a bannable offense to crack russian-authored software.

[deleted]
Post reply on HN