Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AURpocalypse now: a look at the recent AUR attacks

lwn.net

Post reply on HN
Print view View original

51–60 of 104 posts

Re: AURpocalypse now: a look at the recent AUR attacks

#51

Post by butterknife »

akerl_ wrote: post #11
guilhas wrote: post #9

Earlier quoted context omitted.

Gentoo But let's hope we get this solved, like peer review model, vouch, or something It is very good to be able to find build/install files for everything

Gentoo's model appears to be basically the same? Like the AUR, anybody can submit basically anything they want. The requirements amount to containing valid packages, having a bugzilla account, and putting your package definitions in VCS somewhere.

In overlays that need to be explicitly enabled. Not as convenient as yay yolo.

We can also add npm to package.mask.

Re: AURpocalypse now: a look at the recent AUR attacks

#52

Post by eptcyka »

isityettime wrote: post #42
AshamedCaptain wrote: post #5

I'll note that OpenSuse also has Packman which a shitton of people enable (for codecs), has also 'one namespace only' an looser policies than the main distro. I do not think this something you can escape by switching distro.

Zypper at least has a notion of "vendor", so you can arrange things so that only the handful of packages you care about will actually come from Packman. Ubuntu actually has first-party repositories with proprietary codecs. Nixpkgs is a pretty comprehensive monorepo of packages with a more normal review process than the AUR, and it includes non-free software as well, plus the model with flakes for third-party stuff is…

Nix also forces builds to be sandboxed. Now you actually need to run an infected build output to be affected.

Re: AURpocalypse now: a look at the recent AUR attacks

#53

Post by Normal_gaussian »

jchw wrote: post #40

The AUR really has been known to be low-hanging fruit for bad actors, which makes it somewhat surprising it took this long for it to be taken advantage of. I have many opinions regarding this situation, but it mostly doesn't matter. AUR staff and AUR helper developers will figure out what they want to do, hopefully they will find a good approach. But what I personally take away from this is simply that it has become…

I'm not sure if it is that the desktop is being taken more seriously, or that its easier to write code that works on many distributions and configurations, greatly reducing the cost and increasing the value of the existing 'market'.

Re: AURpocalypse now: a look at the recent AUR attacks

#55

Post by npodbielski »

jchw wrote: post #40

The AUR really has been known to be low-hanging fruit for bad actors, which makes it somewhat surprising it took this long for it to be taken advantage of. I have many opinions regarding this situation, but it mostly doesn't matter. AUR staff and AUR helper developers will figure out what they want to do, hopefully they will find a good approach. But what I personally take away from this is simply that it has become…

I would say that it is now very easy to steal 'AI' providers credentials this way. And then you can use them to write more malware or scam or use models for generating speech to call people and get them to 'redeem'. Or at leat to me this seems more sensible than injecting just malware.

Re: AURpocalypse now: a look at the recent AUR attacks

#56

Post by exceptione »

jchw wrote: post #40

The AUR really has been known to be low-hanging fruit for bad actors, which makes it somewhat surprising it took this long for it to be taken advantage of. I have many opinions regarding this situation, but it mostly doesn't matter. AUR staff and AUR helper developers will figure out what they want to do, hopefully they will find a good approach. But what I personally take away from this is simply that it has become…

  > It's getting better, and Linux does have the advantage of having some powerful primitives to exploit, but the desktop suites come from a totally different world,
When opening the printer configuration page in the KDE configuration panel, I was pleasantly surprised to see it's process runs wrapped inside a bwrap session. Cups is a bit of old and dangerous; I'm glad they sealed that off inside a sandbox. If you ask me, I would make this approach the standard for any software. The configuration panel for fonts doesn't need network access, so at least `bwrap --unshare-net`

Re: AURpocalypse now: a look at the recent AUR attacks

#57

Post by dizhn »

akerl_ wrote: post #3
rvz wrote: post #2

Who still uses Arch btw after this?

Is there another distro that has an equivalent of the AUR with handling you think is preferable?

Opensuse OBS. Tiny bit better because the build environment doesn't allow a network and binaries are not allowed as far as I know. Fedora has a similar thing COPR. Both of these support building packages for other distros as well as appimage, flatpak etc.

With opensuse official packages also use the same infrastructure. It is actually quite fascinating and powerful. (I know a lot less about COPR but I would imagine it would be equally as good. Wezterm switched to that for its packages)

Re: AURpocalypse now: a look at the recent AUR attacks

#58

Post by OJFord »

MintPaw wrote: post #30

A side note, isn't package maintenance something that can actually be solved to some extent by LLMs? The prompt would be something like "Clone this repo and build this package while building/bundling as few other packages as possible with minimal code changes." Then set it in a loop on all the packages for a particular system, I don't have experience in package maintenance and would be curious what kind of issues wou…

And everyone does this individually you mean, rather than sharing the result as 'a package'?

It's an interesting idea, not sure I'd recommend it broadly, but if someone told me they prefer to trust an LLM than third-parties I'd get it at least.

Re: AURpocalypse now: a look at the recent AUR attacks

#59

Post by BoingBoomTschak »

jjmarr wrote: post #34
AshamedCaptain wrote: post #5

I'll note that OpenSuse also has Packman which a shitton of people enable (for codecs), has also 'one namespace only' an looser policies than the main distro. I do not think this something you can escape by switching distro.

I use Gentoo. You have to specifically install "overlays" and every package maintainer would make their own overlay. You can't easily take over an overlay without the original person's permission. That being said, still one namespace. Once you add an overlay it can replace any package it wants. It's also Gentoo so too hard for most people to figure out.

[dead]

Re: AURpocalypse now: a look at the recent AUR attacks

#60

Post by BoingBoomTschak »

butterknife wrote: post #51
akerl_ wrote: post #11

Earlier quoted context omitted.

Gentoo's model appears to be basically the same? Like the AUR, anybody can submit basically anything they want. The requirements amount to containing valid packages, having a bugzilla account, and putting your package definitions in VCS somewhere.

In overlays that need to be explicitly enabled. Not as convenient as yay yolo. We can also add npm to package.mask.

https://wiki.gentoo.org/wiki/Project:GURU
Post reply on HN