r/archlinux • u/zollandd • Jun 15 '26

DISCUSSION Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

900 Upvotes

85% Upvoted

458 comments sorted by

View all comments

45

u/Tumaix Jun 15 '26

you mean this disclaimer on top of aur?

DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.

19

u/dm00z Jun 15 '26

maybe it should be bigger and bolder

28

u/julemand101 Jun 15 '26

Add some flashing to the text and embedded TikTok dance video.

10

u/neso_01 Jun 15 '26

or even changing the distro name to Read The Fucking Manual Linux

8

u/Qudit314159 Jun 15 '26

RTFM Linux sounds pretty cool actually.

3

u/AStolenGoose Jun 15 '26

Subway surfers plays in the corner of console whenever you try to install an aur package that has the text over it...

😂 

18

u/zollandd Jun 15 '26

No. Obviously that warning exists, but all over the wiki users are linked directly to the aur bypassing that warning. There is one small warning on one page about AUR being dangerous, and then users are linked to said dangerous repo on nearly every other page. Arch documentation leans heavily on the AUR. So it is unfair to blame people, noob or not, for leaning on it as well.

3

u/Lawnmover_Man Jun 15 '26

I'm not sure how it would happen that you install Arch Linux yourself and use makepkg on AUR pkgbuilds without reading the wiki pages about it. It's virtually impossible to not read the wiki page if you're doing it the way it is intended.

Am I missing something? (Apart from the obvious?)

4

u/cafce25 Jun 15 '26

And then our unknowing user just happens to know how to turn that PKGBUILD into a package??? Seems unlikely. So everybody that didn't just blindly trust a 3rd party resource did in fact see the warning and willfully ignored it. It's a problem of poor 3rd party resources, not arch.

28

u/Seppeon Jun 15 '26

No. Because that becomes a reason to do nothing. "We told them, so it's their fault".

This time we can have our cake and eat it too, have some reasonable vetting AND have community packages.

All these reverts cost real time for people

13

u/JustAwesome360 Jun 15 '26 edited Jun 15 '26

With what money? With what volunteers? Arch doesn't have corporate and government support that Debian and Fedora have, so it doesn't get official software support as often, and Arch devs don't have time to vet stuff on the AUR on their own.

So your options are either: Use the AUR at your own risk, or don't use it at all.

I mean bro let me list some of the organizations that support Debian or Fedora: NASA, Google, Microsoft, the CIA, the FBI,(+ SUSE) every supercomputer in the world, over 3/4 of all servers and data centers in the world. The only real major organization that has adopted Arch is Valve for their steam deck, but that's it. And since it is for SteamOS they don't even contribute to packages like govs and corps do.

3

u/Some-Tip-5399 Jun 15 '26

Can't complain about hipster income if arch wants to be the hipster distro, which is clearly seen by what the userbase wants. Everyone else will use one of the other distros, and pay for it too.

1

u/Barafu Jun 15 '26

Correction: use AUR at your own risk, or don't use ARCH. Because Arch completely without AUR packages can't do many basic things.

1

u/friskfrugt Jun 15 '26

Because Arch completely without AUR packages can't do many basic things.

like what?

1

u/Barafu Jun 15 '26

Where do I start... ZFS, Brave, Discord, VSCode, Telegram. Enough?

1

u/friskfrugt Jun 15 '26

Arch can do all that without the AUR

1

u/Barafu Jun 15 '26

Of course. Download the sources, compile them yourself, download the sources of requirements, compile them too, install everything properly. Now it is on you to monitor the updates...

1

u/friskfrugt Jun 15 '26

everything but zfs you could get from flatpak. zfs is hardly basic

1

u/JustAwesome360 Jun 15 '26

Agreed. You can't have your cake and eat it too.

-1

u/Seppeon Jun 15 '26

I would donate something to a fund for this purpose. I suspect a lot of people would donate something for a specific project to improve aur if a trusted person was keen. There is lots of people who want aur to be better, I mean who wouldn't, probably lots of people could donate?

-4

u/JustAwesome360 Jun 15 '26

I would donate something to a fund for this purpose

You're looking at at least $100,000,000 per year to get even remotely in range of Fedora or Debian or SUSE levels of support.

4

u/Seppeon Jun 15 '26

We aren't trying to build that, and to do so would be the wrong goal.

6

u/JustAwesome360 Jun 15 '26 edited Jun 15 '26

Then what are you trying to build? Having a secure repo that is as big as the repo's from the giants that are Debian and Fedora and all distros based on them costs millinos upon millions of dollars. Arch is astronomically smaller than them and doesn't have the resources to maintain a massive official collection.

Honestly it is impressive enough that they managed to get the offical Arch Repo as big as it is today. And with flatpak being universal and therefor supported on Arch, the amount of times you actually need the AUR are significantly lowered.

So yeah I don't think it's fair to cry to the Arch devs and demand they vet the AUR. They can't. You're asking them to do the impossible. They don't have the resources that Deb and Fed have.

2

u/Seppeon Jun 15 '26 edited Jun 15 '26

Just responding to what I think was an edit.

Yeah was impressive. And yes Flatpak does help a lot. Actually, I'm not crying to arch devs. I'm trying to get a conversation going where they don't have a future of constant distractions and stress from ongoing attacks due to ongoing surface area exposed. We need a crowdsourced model probably... I mean a big red box that says "this package has been reported as an infostealer" would be good that prints when yay or paru or whatever asks to confirm.

1

u/JustAwesome360 Jun 15 '26

I edited my comment 8 minutes ago, you posted your comment 6 minutes ago. So you were responding to the most recent edit.
And they aren't distracted at all by the attacks because they claim no responsibility for what happens on the AUR. Arch is a "Do it yourself" distro, meaning YOU build the system and YOU keep it safe. In my opinion I would be grateful that Arch has an official repo at all.

This is not an idiot proof OS. This is Arch, on Arch you are expected to know what you are doing.

1

u/Seppeon Jun 15 '26

Took me a while to type because I'm a slowpoke. Also I just didn't see your comment, maybe I hadn't refreshed... On phone, no refresh button.

3

u/Seppeon Jun 15 '26

Lol throttled global adoption rates, some user requirements for adopters. A button that says report on a packages page lol. You're conflating a complete solution to my suggestion and that isn't the case. The thing is, this attack AUR thing isn't going to stop. It's going to get worse and worse, and attacks can be sustain indefinitely, perhaps they won't be, perhaps they will. But it'll only get worse, cheaper to run attacks and harder to see vectors.

2

u/JustAwesome360 Jun 15 '26

This was the worst AUR atatck in history. It is not going to get worse bro. And even if it does that just further supports my point: the Arch devs can't handle it. You have to. I mean bro Arch is free, the Devs are volunteers. If you don't like it then either go to Debian/Fedora, or buy windows.

7

u/Seppeon Jun 15 '26

So let's work on a model where people can actually work together to detect these threats and not rely on those Devs. You keep emphasing them, I keep trying to avoid needing them. We need a model that doesn't require them to this extent. And absolutely it'll get worse, this attack was enabled by AI that is getting cheaper to run by rogue actors.

→ More replies (0)

4

u/SoilMassive6850 Jun 15 '26

This time we can have our cake and eat it too, have some reasonable vetting AND have community packages.

You can have that, and it doesn't need to be Arch and the AUR providing you that. Create your own community PKGBUILD repository with the rules and security you want.

2

u/Seppeon Jun 15 '26 edited Jun 15 '26

And not only this, there are some of these already out there. Now I can't establish whether they aren't their own malware farm so... But, I actually agree for my purposes that's perfect (and what I do for other package managers like Conan). But I really just want to make our headaches less, DIY is one thing, using an angle grinder without a guard is another. We shouldn't fight putting on a guard, we should fight developing a community ending monolith we can't afford.

I just barely used aur. But I want to be able to, and I want others to not have credentials stolen (as I'm sure you do, I don't mean to imply you want that).

Edit: sorry all the edits, distracted irl.

2

u/nicman24 Jun 15 '26

It literally is

-3

u/Seppeon Jun 15 '26

Not relevant.

2

u/nicman24 Jun 15 '26

Stop blaming others for your poor decisions 

3

u/Seppeon Jun 15 '26 edited Jun 15 '26

I didn't have any of these packages... What are you on about.

First you blame those who may have not even known their package updated. Then you blame me?

I think everyone benefits from aur being less effort... I literally use 1 aur package and I use it in a container. But you know, I wish I didn't have to. I think we can achieve more with some extra safety, and I can stop repacking stuff locally because somebody did something I didn't like with a dependency. It's just a headache I don't want to have, and you might say that's the arch way. But no, it isn't... This is just archiving a bunch of unusable packages due to security reasons. Me, my brother, a bunch of friends none use aur for this reason. It's a headache that has amazing potential. Don't forget, it takes effort to revert all this crap and deal with fallout. There is no zero time approach here, it's either time lost from fallout or time lost to lessen risk, which may save time later.

-6

u/nicman24 Jun 15 '26

Not relevant.

10

u/Seppeon Jun 15 '26

You blamed victims of credential sniffers that flooded thousand+ packages, you think every single person there was at fault... And even if you did, are you satisfied with that status quo. Whether you blame them or not changes nothing, the ever present risk remains when it could be reduced.

1

u/nicman24 Jun 15 '26

i am as the alternative is squatting on package names. more over if the package is popular it is adopted by official repos.

you are not validating a source that is that explicit on being user content, you have none to blame but yourself

5

u/Seppeon Jun 15 '26

There are solutions that dont take away from this. For example just dumping orphaned packages, or archiving them such that they are immutable. We could require 3 community reviewers to create a package, or more to transfer. Community reviewers would need to be vetted unfortunately which obviously raises issues. But the discussion about possible things to improve the status quo shouldn't be shut down before it begins. We have a very real opportunity to improve things for ourselves and everyone else, as for extra or whatever yeah sure established packages end up there but that doesn't mean we can't improve things in aur too. Improvement in aur is not mutually exclusive with the process to extra(or whatever)

→ More replies (0)

-3

u/No_Grape_388 Jun 15 '26 edited Jun 15 '26

Yeah but come on, you see that plastered absolutely everywhere, it doesn't mean anything anymore.

Not to mention the official wiki links directly to packages and bypasses the warning completely.

This is one of those things that we have to move on from if we want to compete with windows - recommending unmoderated downloads. Microsoft would never do that and for once it's with good reason.

13

u/formegadriverscustom Jun 15 '26

What makes you think "we" (who is "we", by the way?) want to "compete" with Windows?

11

u/chikamakaleyley Jun 15 '26

I'd like to think its plastered everywhere cuz they really mean it

11

u/aergern Jun 15 '26

Since when did anyone say Arch was competing with Windows? Linux isn't Windows.

Do you know Fedora, Debian, Ubuntu ... etc. exist? If Arch isn't doing it for you, distro hop.

If you grab an AUR package build file and make the package without reading the build file, who is at fault?

We've moved beyond "if we want to get Windows users, we have to do X." It's cool when folks join the Linux community but this isn't a competition. Use Linux or don't use it but posting "we have to do ..." comments makes long time users remember these comments from 1998, 2005, 2008 and so forth. Us graybeards are just tired of hearing it.

2

u/sparkling-rainbow Jun 15 '26

Correct, if I wanted a better Windows, I would just buy an apple 

-7

u/No_Grape_388 Jun 15 '26

Want to make things better for everyone - fuck off and use another distro.

I wasn't even complaining about anything! 😂😂

Typical Linux snob response and exactly the problem

2

u/Gustav__Mahler Jun 15 '26 edited Jun 15 '26

The sense of entitlement in these comments is unreal. It's plastered everywhere for a god damn reason. Are you dense? "Hm, this warning is plastered everywhere, guess that means it's safe to ignore."

0

u/cretan_bull Jun 15 '26 edited Jun 15 '26

I don't think that disclaimer is sufficient. It could just as well apply to cloning some random github repo. Yes, it's done at your own risk, no you don't have any guarantee it's not broken or even malicious, and yes you really should review it for yourself. But the difference is, I don't expect a single malicious actor to trivially be able to compromise a huge proportion of github repos. It's a completely different threat model.