Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AURpocalypse now: a look at the recent AUR attacks

lwn.net

Post reply on HN
Print view View original

21–30 of 104 posts

Re: AURpocalypse now: a look at the recent AUR attacks

#21

Post by zbentley »

AquaWeasel wrote: post #19

Despite that official Arch repos weren't affected in this attack, I would not recommend using Arch (or any rolling release distro) for anything that requires security. (Imagine if the xz backdoor targeted Arch...) An Arch maintainer that I personally know once admitted that he rarely review upstream changes when bumping package versions. He only does that when the build breaks. I can't blame him for what he did, sinc…

> An Arch maintainer that I personally know once admitted that he rarely review upstream changes when bumping package versions.

Cool story bro. Assuming that's common, I have trouble understanding why Arch (non-AUR) is any more at risk than Debian--besides the latter being more popular and having more users/incidental testers, which is a real benefit if that's your goal, but has its own drawbacks (like older and known-vulnerable packages lingering for longer before updated releases are made available).

> it's not reasonable to ask package maintainers to spend all their time on those stuff, especially in this "Age of AI"

Aren't Debian and friends similarly at risk of this as well, then?

> security practices (such as TOTP, sandboxing browsers and video players, etc.)

I'm not sure if those are more or less prevalent on Arch; I know that many IDEs and GUI programs I've installed on Arch ran by default in Flatpaks or similar, and Debian/Ubuntu like Snaps, but I'm honestly not familiar with whether those ecosystems have significant and/or equivalent penetration in different distros.

Re: AURpocalypse now: a look at the recent AUR attacks

#22

Post by PalmPilotProMax »

cqz wrote: post #12
AshamedCaptain wrote: post #5

I'll note that OpenSuse also has Packman which a shitton of people enable (for codecs), has also 'one namespace only' an looser policies than the main distro. I do not think this something you can escape by switching distro.

Yes, the only reason this isn't happening in other distros is simply popularity. Namespacing is the solution, and as mentioned in the article some ditros do indeed have namespaced user repos, like Fedora's Copr. The trust model of a flat namespace user repo is completely broken when the maintaining user can change at any moment.

Isn't Arch's AUR flat namespace quite unique? Ubuntu's PPAs are also not flat.

Re: AURpocalypse now: a look at the recent AUR attacks

#23

Post by Ferret7446 »

AquaWeasel wrote: post #19

Despite that official Arch repos weren't affected in this attack, I would not recommend using Arch (or any rolling release distro) for anything that requires security. (Imagine if the xz backdoor targeted Arch...) An Arch maintainer that I personally know once admitted that he rarely review upstream changes when bumping package versions. He only does that when the build breaks. I can't blame him for what he did, sinc…

I don't think Arch maintainers are responsible for auditing upstream. They package the upstream only.

Re: AURpocalypse now: a look at the recent AUR attacks

#25

Post by cookiengineer »

Note that the AUR attacks were part of the larger miasma worm campaign, gradually trying to gain more control through various package ecosystems since the RedHat prototype campaign.

Mitigation Tool: https://github.com/cookiengineer/antimiasma

Blog Post with details: https://cookie.engineer/weblog/articles/malware-insights-mia...

Re: AURpocalypse now: a look at the recent AUR attacks

#27

Post by badreligion42 »

AshamedCaptain wrote: post #5

I'll note that OpenSuse also has Packman which a shitton of people enable (for codecs), has also 'one namespace only' an looser policies than the main distro. I do not think this something you can escape by switching distro.

Packman is more akin to rpmfusion, than AUR. OBS is the AUR equivalent for OpenSUSE.

Re: AURpocalypse now: a look at the recent AUR attacks

#29

Post by skjfjnflw »

zbentley wrote: post #21
AquaWeasel wrote: post #19

Despite that official Arch repos weren't affected in this attack, I would not recommend using Arch (or any rolling release distro) for anything that requires security. (Imagine if the xz backdoor targeted Arch...) An Arch maintainer that I personally know once admitted that he rarely review upstream changes when bumping package versions. He only does that when the build breaks. I can't blame him for what he did, sinc…

> An Arch maintainer that I personally know once admitted that he rarely review upstream changes when bumping package versions. Cool story bro. Assuming that's common, I have trouble understanding why Arch (non-AUR) is any more at risk than Debian--besides the latter being more popular and having more users/incidental testers, which is a real benefit if that's your goal, but has its own drawbacks (like older and know…

Debian freezes the package versions on release of each Debian version and then cherry picks critical fixes for the rest of the Debian version's lifecycle. So even if they never review the code (and I don't expect them to), they're less likely to release malware before it's discovered by others.

Re: AURpocalypse now: a look at the recent AUR attacks

#30

Post by MintPaw »

A side note, isn't package maintenance something that can actually be solved to some extent by LLMs? The prompt would be something like "Clone this repo and build this package while building/bundling as few other packages as possible with minimal code changes."

Then set it in a loop on all the packages for a particular system, I don't have experience in package maintenance and would be curious what kind of issues would come up.

Post reply on HN