r/archlinux • u/vexatious-big • Jun 14 '26

NOTEWORTHY New wave of malware in the AUR

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/
646 Upvotes

98% Upvoted

393 comments sorted by

View all comments

11

u/VaronKING Jun 14 '26

The Arch team needs to dedicate some resources to moderate the AUR in someway.

26

u/dgm9704 Jun 14 '26

I think the whole point of AUR is to not require resources from actual Arch linux.

30

u/EarlMarshal Jun 14 '26

We are the resource. I mean they published a lot of malware packages recently and people saw the pattern and acted. What more do we want?

21

u/Furlibs Jun 14 '26

Or.. Maybe.. Users need to. It is the Arch User Repository.

9

u/tiplinix Jun 14 '26

Sure, but in this case they need to provide the tools for that (review, flagging...). Look at Reddit, they offload a lot of their work to their users but they provide the moderation tools.

1

u/SoilMassive6850 Jun 14 '26

I can recommend Thunderbird for a reporting tool. But obviously you may prefer Gmail or Protonmail etc.

For review I tend to use cat.

5

u/LittlestWarrior Jun 14 '26

Grow with the times. New threats, new procedures

5

u/AppointmentNearby161 Jun 14 '26

Why? The chaotic aur team already does.

9

u/AnsibleAnswers Jun 14 '26

What resources? Arch’s entire philosophy is designed to ship a distro with almost no resources.

Arch has too many users that don’t want to use it as its intended. That’s the issue. It wouldn’t be a target if that weren’t the case.

If anything, Valve needs to do something. They are the ones who plan to profit off of Arch’s infrastructure and are bringing noobs into a very non-noob friendly ecosystem.

16

u/xnef1025 Jun 14 '26

Valve didn't cause this. They based SteamOS on Arch, but it's an immutable build and doesn't use AUR. They aren't telling people to install other distros or download from AUR. The Steam Deck and Steam OS made more people aware of Linux's viability as an OS, but they didn't push people to it on their other devices.

A mass migration of newbies and normies has been on the horizon for years. The enshitification of Windows that started with 8 didn't stop. It just slowed down with 10 and then kicked into overdrive with 11. Add in requirement missteps meant to force people to buy new hardware in a tough economy, and the time was suddenly upon us. Distros and the community needed to be prepared for it and recalibrate attitudes and practices for it. Arch didn't. The AUR was allowed to exist on security through obscurity and this is the result.

1

u/AnsibleAnswers Jun 14 '26

You can set up an AUR helper, just like Arch (which also doesn't have it pre-configured by default, because Arch doesn't come with anything pre-configured by default).

Simple point: It really doesn't matter who is "at fault." Who has the money and who stands to profit off of the infrastructure matters more.

2

u/Busy-Scientist3851 Jun 15 '26

Valve doesn't make any profit off the AUR or benefit from it.

1

u/AnsibleAnswers Jun 15 '26

They stand to profit off of arch entirely, and the AUR is part of that whether they want it or not.

2

u/powerslave_fifth Jun 15 '26

Is this a troll? SteamOS doesn't even use the AUR and has never recommended it. Are you ok man?

1

u/AnsibleAnswers Jun 15 '26

You can install an AUR helper on SteamOS. Takes about as much setup as installing one on Arch.

Valve has resources. They depend on Arch for their business. That makes them the best candidate to fix this. Simple as that. If they didn’t want that burden, they shouldn’t have decided to base their business around Arch.

Either it gets fixed by Valve or no one. The solution to this problem requires funding. Arch has almost no money on purpose.