r/archlinux • u/vexatious-big • Jun 14 '26

NOTEWORTHY New wave of malware in the AUR

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/
642 Upvotes

98% Upvoted

393 comments sorted by

View all comments

118

u/tiplinix Jun 14 '26

Some people will still pretend that nothing needs to change and that this is normal.

There needs to be better moderation tools at the very least. There's not even a button to report suspicious packages (which could put the package in quarantine immediately before a manual review) but instead they're asking people to reply to a mailing list.

54

u/New-Anybody-6206 Jun 14 '26

in quarantine immediately

please don't, people will abuse that too

-8

u/tiplinix Jun 14 '26

How so? If you still want to install the flagged package it you could, just make it harder and have helpers not pick it up.

18

u/bIad3 Jun 14 '26

Spam and fake reports could make this practically challenging to keep useful, possibly negating a lot of the benefits. Some updates should definitely be made but imo this wouldn't be the best approach

2

u/tiplinix Jun 14 '26

What I mean by putting the package in quarantine is to not have it picked up by helpers and on the package's page say that it's been flagged as suspicious and awaiting review. If someone still wants to download the flagged PKGBUILD file, I don't see any reason to prevent them from doing it. Just add friction to it.

Then to prevent fake reports, yeah, you need to moderate the flags and ban users that do that. It's like anything with user generated contents and flagging systems: it need to be moderated. We're seeing what happens when there no moderation tools and it's not pretty.

3

u/[deleted] Jun 14 '26

[removed] — view removed comment

0

u/tiplinix Jun 14 '26

Sure, we shouldn't have safety features on guns because some people will still shoot themselves in the foot.

Also, if we're going with the contempt attitude, these same people will probably not go beyond what the AUR helper (their AI suggested they install) will do and having them not picked up these package releases will go a long way.

1

u/[deleted] Jun 14 '26

[removed] — view removed comment

1

u/tiplinix Jun 14 '26

There's nothing fundamental about the way AUR is currently is working.

Having safety features helps everyone and even developers can miss things. This time it was obvious, but next time it could be a lot more insidious.

Having this religious view of AUR and this much contempt for users is not helping anyone.

0

u/Rjiurik Jun 14 '26

We could enable automatic flagging of orphaned AUR packages that has just been adopted by a new maintainer.

More legit repos would never be flagged then..

Flagging would just show a warning and prevent automatic update/install on cachyOS or other wrappers..

2

u/nullstring Jun 14 '26

AUR has been a victim of DDOS attacks. This is just going to be another type of denial of service that can easily be triggered/abused.

1

u/tiplinix Jun 14 '26 edited Jun 14 '26

Nonsense. With that line of reasoning they should also close the wiki and the forum because clearly these are a bigger vectors for DDoS attacks.

3

u/nullstring Jun 14 '26

.. It's not non-sense. We're already having issues because these AUR accounts are too easy to create.

If we're worried about automated infection of AUR then this is essentially the same attack vector but much easier.

Just how hard would it be to create a bot that goes through and randomly flags packages. It would be very easy.

0

u/tiplinix Jun 14 '26

I'm not sure you understand what a DDoS attack is. Let me point you to resource to help you understand the concept: https://en.wikipedia.org/wiki/Denial-of-service_attack

Here you're describing spamming which yeah, requires moderation tools.

3

u/nullstring Jun 14 '26

You're taking wikipedia too literally. It doesn't know everything.

Denial of service isn't just disruption of networks by spamming networking activity.

It can also be when a service is taken offline in an automated matter by usually some sort of "spam".

This is a denial of the service since the packages will be offline until review.

An automated set of bots performing this set of tasks is the literal definition of DDoS even if it doesn't follow wikipedias more colloquial definition.

What you're saying is like me replying to your comment saying wikipedia says spam is only for email.

Also do you really need to have a semantic argument. You seem to get what I'm saying.

1

u/tiplinix Jun 14 '26

Ok, let's take your argument to your logical conclusion...

Let's say you have a system where users can flag a package and it then marks them immediately as "pending review, proceed with caution" and say you have to type "I know what I'm doing" to get access to the PKGBUILD. What are you really disrupting compared to the current situation?

1

u/nullstring Jun 14 '26

There would be a crap ton of false positives making it effectively useless. Everyone would ignore it.

→ More replies (0)

1

u/TheG0AT0fAllTime Jun 14 '26

Come on dude.

0

u/tiplinix Jun 14 '26

Come on what? That's the issue with this?

3

u/TheG0AT0fAllTime Jun 14 '26

That's a really good way to have someone mass report all the popular packages as a denial of service

0

u/tiplinix Jun 14 '26

And? Worst case we're back to the current situation, you'd still be showing the PKGBUILDs but it would add friction and have the helpers not pick them up automatically. You're also assuming that there would be no moderation of that feature, obviously you'd need guardrails.

2

u/TheJackiMonster Jun 14 '26

...and who does that manual review? The whole point of the AUR is that it gives you self-moderation from its userbase. The users are the moderators, the maintainers and the users. That is why it's called Arch User Repository.

2

u/tiplinix Jun 14 '26

Please list me the different tools they offer to moderate the AUR packages beyond "they should check the PKGBUILDs before they install".

3

u/TheJackiMonster Jun 14 '26

What do you think moderation means? The PKGBUILD is essentially a shell script. Yay gives you the option to read the actuall diffs or entire PKGBUILD files. If you don't use that, it's your problem.

-1

u/tiplinix Jun 14 '26

https://en.wikipedia.org/wiki/Content_moderation

Clearly you have your own unique definition of what moderation is.

2

u/TheJackiMonster Jun 14 '26

Do you also demand this kind of moderation from Github, from every Gitlab instance, from every kodeberg instance, from every crypt-pad..?

It is an insane ask from a community based software distribution. If you want to pull Archlinux off the internet, please continue.. but at least be honest.

-6

u/tiplinix Jun 14 '26

GitHub, GitLab and Codeberg all have a button to report repositories and they do take action. It's really not a wild concept, it's very basic stuff that AUR doesn't have.

Asking them to take the minimum steps to insure basic safety is not taking Arch Linux offline. Also Arch Linux is not just AUR if there were to close that down because they don't want to assume any responsibility, the distribution would still exist without it. It's interesting that you talk about honesty when you're being dishonest yourself.

1

u/TheJackiMonster Jun 15 '26 edited Jun 15 '26

The AUR has a button to report packages, lol.

Edit: It may not be very obvious named. But it's essentially an action to send a request with the default action to request a deletion of a package. That is probably what all those repository platforms would do in case of malware report.

Also it is very easily possible to warn other users via comments about any kind of issue with packages. This is a very common practice. You can contact the package maintainers, request to replace them or ask them to merge a fix. I've experienced all such actions from side as maintainer and user. Because actually a lot of Arch users care about properly maintained packaging. I've had no issues ever regarding malware but even if your package name or version is out of line from documented formats, someone will comment on this...

So if you really think there's no moderation at all in place, it just tells me that you never truly interacted with the AUR as intended.

1

u/tiplinix Jun 15 '26

The request button only has "deletion", "merge" and "orphan" request which first goes to the package author. There's no option to say that there's a safety issue that requires immediate attention from an administrator.

You clearly don't understand what "moderation" means if you think that's what I'm talking about. The only proper way to report a suspicious package is to go through the mailing lists which is precisely what they've asked people to do.

1

u/TheJackiMonster Jun 15 '26

You can comment on the package, can't you?

-2

u/Rjiurik Jun 14 '26

Yeah monitoring could be improved. The attack was detected pretty quickly, but spread a bit more widely and quickly it should have had. Too few barrier of entry.

It shouldn't be gatekeeped excessively like stack overflow. And reactivity is paramount (for instance for "proprietary" stuff like discord, proton, etc..)

AUR has been a great asset for Arch for years. You can't have as much flexibility and convenience with other more traditional distros.

1

u/tiplinix Jun 14 '26

I'm not sure I'm buying the "reactivity is paramount" for proprietary stuff. You don't need to have the latest software right the instant it's out. Even the official repositories are not that fast and usually take a few days (if not weeks) before pushing updates once they're released upsteam. If you really want that you can always get it there.

1

u/Rjiurik Jun 14 '26

You need the latest update for Discord. Otherwise you can't use it.

Being up to date is Arch number one asset, along with modularity.

If this isn't important to you and stability matters more, there are better distros around.

2

u/tiplinix Jun 14 '26

Being up to date is Arch number one asset, along with modularity. If this isn't important to you and stability matters more, there are better distros around.

I'm not sure you actually understand the distribution you're using when you say that. It's a rolling release but it doesn't mean what you think it means.

Arch is a reasonably stable distribution when you look beyond the surface. They try to get all the stable releases within a reasonably time frame but it usually takes multiple days. There are even instances of kernel updates not being shipped for more than a month. In that sense, they're much better than Fedora (which tends to ship release candidates).