As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.
Is arch exploding in popularity? Because of Omarchy or something else?
[deleted]
Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
21–30 of 142 posts
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#22As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.
Is arch exploding in popularity? Because of Omarchy or something else?
The current iteration of SteamOS (the one shipped on Steam Deck) is Arch based. So a lot of non-linux users got exposed to it as their first linux distro. Especially with all the emulation guides and other random guides for doing "advanced" stuff to your Steam Deck by dropping in the Arch-ish desktop.
Also anyone who wants to try "Gaming on Linux" needs bleeding edge kernel which is Arch's default setup compared to other distros.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#23Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#24Any clue what these packages were 'supposed' to do or why somebody might have installed them? Their PKGBUILD descriptions are copies of the respective browsers', not explaining the -patched part.
I wondered about the same thing. Not an answer, but my guess would be that it's just a new package and they hoped someone picked it up by accident?
In that case, it was patched with malware :)
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#25Could there be programmatic ways to help users characterize the safety of the AUR packages they install? Perhaps a program that prints all URLs in the PKGBUILD and offers the option for the user to open them in the browser? Or which automatically shows a diff if a PKGBUILD is updated? Highlighting changes would make it easier for the user to determine if he should spend time exploring those changes for malware. One c…
PKGBUILDs are just bash scripts following a certain function and variable naming convention. Even if you could somehow parse it safely and extract the URLs of the 'source' array, any attacker can just simply put an obfuscated version of the malware URL into the build() function and download it there.
AUR clients already show you the diff if you update a package, but note that this were completely new packages anyway, uploaded 2 days ago, so that doesn't really apply here.
LLMs are useless for reviewing if something is malicious, their false-positive rates would be way to high. And even ignoring that you'd have to hide the LLMs code from the attacker or he can just check if his package is detected as malicious and modify it until it isn't. Not something open source projects are keen on doing.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#26Any clue what these packages were 'supposed' to do or why somebody might have installed them? Their PKGBUILD descriptions are copies of the respective browsers', not explaining the -patched part.
I wondered about the same thing. Not an answer, but my guess would be that it's just a new package and they hoped someone picked it up by accident? In that case, it was patched with malware :)
They (or someone in cahoots with them) made at least one attempt [0] to lure readers of the Arch Linux subreddit to the malicious PKGBUILD.
IIRC, the post was just a single paragraph, praising how they “found” the zen-browser-patched-bin package on the AUR and how much it helped them.
[0]: https://www.reddit.com/r/archlinux/comments/1m30py8/aur_is_s...
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#27Earlier quoted context omitted.
Is arch exploding in popularity? Because of Omarchy or something else?
I think I saw posts on Reddit with XQC saying Arch is the best. I mean it is. And I use Arch btw.
An evaluation of what's best really depends on how one weighs different tradeoffs. For example, Debian and Arch are basically polar opposites in terms of two questions:
1) do you want an intermediary between you and the upstream? for example, to patch out telemetry
2) is it important that what you're using continues to work the same way so you can focus on your actual work?
No answer to either is consequence-free, e.g. for 1), see the Debian SSH patch event, or for 2), if the answer is "it doesn't work", then that kinda forces one's hand.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#28As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.
Is arch exploding in popularity? Because of Omarchy or something else?
CachyOS (Arch based distro), no.1 on https://distrowatch.com/
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#29Earlier quoted context omitted.
Is arch exploding in popularity? Because of Omarchy or something else?
CachyOS (Arch based distro), no.1 on https://distrowatch.com/
> Blazingly Fast & Customizable Linux distribution
I love Arch Linux, but please...
(Arch Linux is already "fast" (depends on what you install for your DE, if any) and customizable.)