Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
1–10 of 227 posts
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#2As always a fair reminder to not install random 3rd party packages/libraries/applications without reviewing them, especially when there is zero vetting. Luckily this was constrained to AUR, which basically is a free-for-all package repository, with users being warned multiple times that it's vital to review anything before you install it, compared to the official repositories.
`rua` and other similar CLIs make it really easy to review the packages before installing them from AUR too, and if you are doing banking on the same computer, you really have no excuse not to review the software you depend on. Keeping the amount of packages low, only use what you need, also makes this a whole lot simpler when it's time to upgrade.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#3How bad was it?
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#4How bad was it?
1,500 packages out of 107,000 so pretty bad, ameliorated by only affecting installs of those in a window of a few days.
AUR comes with a warning that its up to you to check what you install from there.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#5I cringed hard when some people started to make pacman wrappers that could install from AUR directly.
I've installed stuff from the aur before but most of the times I prefer to skip the middleman and just navigate to the project website. A premade pkgbuild is not convenient enough to take the risk of typoquatting or the tactical npm or pip dependency.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#6[flagged]
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#7As I undertood it this was mostly orphaned packages?
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#8I cringed hard when some people started to make pacman wrappers that could install from AUR directly. I've installed stuff from the aur before but most of the times I prefer to skip the middleman and just navigate to the project website. A premade pkgbuild is not convenient enough to take the risk of typoquatting or the tactical npm or pip dependency.
For me, this tradeoff isn’t worth it. I didn’t switch to Linux so that I can waste time going to websites and clicking “download” to update my programs like a Windows user.
The pacman wrappers you mention are crazy, though.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#9I’ve made a point of not installing any AUR packages. It’s really tempting when there’s a package that’s not available via pacman, but at the end of the day I’d rather build from source myself or use a docker image.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#10As I undertood it this was mostly orphaned packages?
That's correct, orphaned packages could be adopted seemingly automatically, so someone did and then published malware in bulk.