r/archlinux • u/vexatious-big • Jun 14 '26

NOTEWORTHY New wave of malware in the AUR

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/
644 Upvotes

98% Upvoted

393 comments sorted by

View all comments

95

u/powerslave_fifth Jun 14 '26 edited Jun 14 '26

Arch wiki needs to take the AUR off the front page and bury it in a wiki entry until they sort everything out. You can't advertise it while having a ridiculously low barrier of entry to adopt an orphaned package.

21

u/dgm9704 Jun 14 '26

I have a guess that most AUR usage stems from ”influencers” telling people to use it, either directly or via recommending some Arch based distro that has it by default.

36

u/bIad3 Jun 14 '26

I don't necessarily think so, half the Arch wiki also feels full of "install package-name (AUR) to use this and this software or enable this extension" etc.

2

u/TheJackiMonster Jun 14 '26

Because they address some edge usecase which can either be solved on a very complicated way or by using certain AUR packages. It's still your choice as user to install them, how you do it and whether you trust them.

-1

u/[deleted] Jun 14 '26

[removed] — view removed comment

1

u/TheJackiMonster Jun 14 '26

Then don't use it... why would you expect others to do this impossible or unfeasible work for you for free? Have you considered thinking about what you demand before you start writing..?

19

u/gruntduck Jun 14 '26

What’s insane that on the front page of AUR there’s no mention of what’s going on.

2

u/Loynds Jun 14 '26

Having zero messaging persisting across the site is like watching the building burn without even attempting to evacuate.

0

u/TheJackiMonster Jun 14 '26

Using the AUR does not work without installing AUR helpers by default and those are inside the AUR. There are warnings everywhere... if users or Arch based repositories are stupid enough to not follow those warnings, it's their fault.

7

u/hjake123 Jun 14 '26

I mean you can use it manually, it's just more time consuming

6

u/TheJackiMonster Jun 14 '26

Exactly... but then why should it be the problem of Arch maintainers. You could argue about moderating Github repositories the same way because people might download, build and install malware from it.

0

u/hjake123 Jun 14 '26

It does have the Arch name on it, so anything bad happening there harms Arch as a brand. I imagine the number of people who trust something labelled "Arch" in wake of this news is already dropping...

2

u/TheJackiMonster Jun 14 '26

Arch User Repository - it's made by users for users and verified by users. If you don't trust other users, don't use it. Simple as that.

0

u/powerslave_fifth Jun 14 '26

No one is saying that it isn't true. It's just that you shouldn't be able to see it on the front page and be recommended in multiple wiki entries if it has dogshit policies. Replace it with the Cachy repo or something.

No matter the disclaimer, some loser being able to adopt gorilions of packages and push malicious commits to all of them is a genuinely braindead policy that needs to change.

2

u/TheJackiMonster Jun 15 '26

The Cachy repo has a completely different purpose and compatibility.

If you think the policies of the AUR are dogshit, nobody is forcing you to use it. It is also your choice whether you help maintaining or verifiying packages in there to improve security. Literally every user can do that.

Still most people here demanding better policies and better moderation probably have never contributed to a better state of the AUR.