Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux disables AUR package adoption

lwn.net

Post reply on HN
Print view View original

31–40 of 134 posts

Re: Arch Linux disables AUR package adoption

#31

Post by jolmg »

sp0rk wrote: post #11
WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

> I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux? This has absolutely not ever been the case.

It is, among most users, but it only takes a few abusing that for it to seem like there's none.

EDIT: Rereading, maybe it's that other kind of "hacker"...

Re: Arch Linux disables AUR package adoption

#33

Post by shevy-java »

WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

Could be AI slop attacks made attacks easier in general. Though, the Arch Linux model was probably never an ideal security model. It seems the easy days of the 1990s are over finally.

Re: Arch Linux disables AUR package adoption

#34

Post by Matl »

vlovich123 wrote: post #29

> The project had suspended new account registration in June. That followed a campaign in which an attacker or attackers created new accounts to adopt orphaned packages and push malicious updates to them that would install malware on user systems. AUR registration was reopened on July 13 after the DevOps team added some minor, and apparently ineffective, restrictions on creating new accounts. Disabling AUR package ad…

Well, this kills a very useful feature of the AUR. It's like Wikipedia disabling editing. So I can see trying other things first before resorting to removing features, but I do agree it should have happened faster.

Re: Arch Linux disables AUR package adoption

#35

Post by Matl »

charcircuit wrote: post #9
WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

Desktop Linux has always been a house of cards in regards to security. I agree it's amazing that it went on for so long, but this was inevitable.

With regards to sandboxing etc. maybe. With regards to packages? Official repos support signing and usually rely on maintainers with proven track records. AUR was a honor system and since some people are total basement losers, you can't rely on that.

Re: Arch Linux disables AUR package adoption

#36

Post by warkdarrior »

nvme0n1p1 wrote: post #21
dandersch wrote: post #10

I think Arch has to rethink what the AUR really is for in the age of AI. If users aren't supposed to trust anything from the AUR, then they will start to use LLMs to scan PKGBUILDs for them. But at that point, why not let the LLM loose directly on the upstream repo and build+install the package from source?

You really don't see the difference between a deterministic script installing a tarball pinned by its hash, and "sudo chatgpt install master branch of this repo"?

Yes, the second option gives me an easily inspectable list of results (as I can see all the tool calls the model made). The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations.

Re: Arch Linux disables AUR package adoption

#38

Post by hnlmorg »

jolmg wrote: post #14
WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

Arch is simply getting popular enough to be targeted.

It had been for a long time now.

What’s more likely is the effort required for large scale attacks is easier now than ever thanks to LLMs.

Re: Arch Linux disables AUR package adoption

#39

Post by Matl »

warkdarrior wrote: post #36
nvme0n1p1 wrote: post #21

Earlier quoted context omitted.

You really don't see the difference between a deterministic script installing a tarball pinned by its hash, and "sudo chatgpt install master branch of this repo"?

Yes, the second option gives me an easily inspectable list of results (as I can see all the tool calls the model made). The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations.

Arch is famously x64 only?

Re: Arch Linux disables AUR package adoption

#40

Post by GreenVulpine »

charcircuit wrote: post #9
WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

Desktop Linux has always been a house of cards in regards to security. I agree it's amazing that it went on for so long, but this was inevitable.

Better than the commercial alternatives
Post reply on HN