Fantastic and anti-sensationalism write-up from LWN, as usual. They continue to deserve my monies.
AURpocalypse now: a look at the recent AUR attacks
61–70 of 104 posts
Re: AURpocalypse now: a look at the recent AUR attacks
#62The AUR is effectively a pastebin for PKGBUILD files.
Some people (many of which don't even use Arch itself) have been treating and advertising it as something different. It's not a software distribution method meant for normal computer users.
Re: AURpocalypse now: a look at the recent AUR attacks
#63The AUR really has been known to be low-hanging fruit for bad actors, which makes it somewhat surprising it took this long for it to be taken advantage of. I have many opinions regarding this situation, but it mostly doesn't matter. AUR staff and AUR helper developers will figure out what they want to do, hopefully they will find a good approach. But what I personally take away from this is simply that it has become…
I think KDE's approach is a greater danger. They both come with warnings, but with AUR (depending on tools) allows you to inspect the PKGBUILD. KDE just gives you a warning and no easy way of looking at what you are installing, it is not clear what contains executable code, and its enabled by default.
In general things that are not part of your distro's supported repos (KDE's AUR, language package installers like npm and pypi, Ubuntu PPAs, etc.) seem to present far more of a risk.
Re: AURpocalypse now: a look at the recent AUR attacks
#64Despite that official Arch repos weren't affected in this attack, I would not recommend using Arch (or any rolling release distro) for anything that requires security. (Imagine if the xz backdoor targeted Arch...) An Arch maintainer that I personally know once admitted that he rarely review upstream changes when bumping package versions. He only does that when the build breaks. I can't blame him for what he did, sinc…
I don't think Arch maintainers are responsible for auditing upstream. They package the upstream only.
If you package software for a distro, you have some responsibility for reviewing what you publish.
If you distribute an update that has malware, that is you publishing malware.
Re: AURpocalypse now: a look at the recent AUR attacks
#65I love the smell of npm install malware in the morning.
Yes, feels like in those cases npm and bun are not far away. Coincidence?
Re: AURpocalypse now: a look at the recent AUR attacks
#66Despite that official Arch repos weren't affected in this attack, I would not recommend using Arch (or any rolling release distro) for anything that requires security. (Imagine if the xz backdoor targeted Arch...) An Arch maintainer that I personally know once admitted that he rarely review upstream changes when bumping package versions. He only does that when the build breaks. I can't blame him for what he did, sinc…
It's a complete fantasy that Debian maintainers do a thorough review of changed packages. It's not a responsibility they have, and it would be impossible anyway (how many packages are there in Debian? How many maintainers are there?).
Re: AURpocalypse now: a look at the recent AUR attacks
#67The AUR is effectively a pastebin for PKGBUILD files. Some people (many of which don't even use Arch itself) have been treating and advertising it as something different. It's not a software distribution method meant for normal computer users.
And for those that aren't aware, a PKGBUILD file is just a bash script.
Re: AURpocalypse now: a look at the recent AUR attacks
#68Humble question: how do you find out if your system has been affected by a malware?
I know that for AUR there was a specific list of affected packages (that I checked, and haven't installed any of them), but I'm interested more in a general way. It could be from AUR, npm, or many other sources. Some malware could break and lock immediately the system, but other could stay there silent for months, so how to find out if there is any?
I haven't run an antivirus since I last used Windows 20 years ago.
Re: AURpocalypse now: a look at the recent AUR attacks
#69Earlier quoted context omitted.
Gentoo's model appears to be basically the same? Like the AUR, anybody can submit basically anything they want. The requirements amount to containing valid packages, having a bugzilla account, and putting your package definitions in VCS somewhere.
In overlays that need to be explicitly enabled. Not as convenient as yay yolo. We can also add npm to package.mask.
Yay isn’t in the official arch repos? The only way you get stuff from the AUR is by explicitly pulling down to repo and building with makepkg or explicitly finding and installing an AUR “helper”.
Re: AURpocalypse now: a look at the recent AUR attacks
#70Who still uses Arch btw after this?
Is there another distro that has an equivalent of the AUR with handling you think is preferable?
No because there’s no way to handle an open submission repository at all. It’s impossible by design since anyone can submit packages to it.
I would never use anything equivalent to AUR on any distro due to the obvious security implications. That’s been my position for as long as I have known about Arch. I never understood Arch users using the AUR as a selling point for the distro.
Then again I live in the opposite end of the spectrum where I run only Debian Stable on my Linux desktop as well as my servers, where packages make it through Sid and Testing before getting to Stable and I can be relatively sure any supply chain attacks have been caught by then (like xz for example which was caught before it left Sid).
For those unfamiliar with Debian, Sid is basically a rolling release similar to using Arch with the official repositories (which is already dangerous without even touching the AUR), then packages move to Testing, then later eventually make it to Stable.