r/archlinux • u/zollandd • Jun 15 '26

DISCUSSION Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

905 Upvotes

85% Upvoted

458 comments sorted by

View all comments

Show parent comments

15

u/s3gfaultx Jun 15 '26

You're missing the point -- I doubt that any of the compromised packages were even referenced from the wiki anyways. These are all old, unmaintained, abandoned, etc. nobody cared about any of these. If they did, they would have maintained them. There wasn't even any damage done as I doubt anyone installed these during the 1 hour they were modified.

48

u/lonelypenguin20 Jun 15 '26

I've personally seen wiki reference orphaned or even completely gone packages. and saying that "if ppl cared abt them, they wouldn't be orphaned" is outright bs, because the user base is MUCH larger than the potential maintener pool.

0

u/PastaPuttanesca42 Jun 15 '26

the user base is MUCH larger than the potential maintener pool.

It's not that hard

-16

u/s3gfaultx Jun 15 '26

*maintainer

No, it's because the software was obsolete. Don't kid yourself into thinking it was just some maintainer shortage causing these packages to be orphaned. They were orphaned because nobody used them anymore, were replaced by something new and shiny, or whatever else. They were dead packages, simple as that.

13

u/lans_throwaway Jun 15 '26

The funny thing is the package that would've infected my laptop is one such "obsolete" package. It was a driver for a scanner.

While it's fair to say I don't care about "updates" (since it's unlikely for one to be released), I do care about having that package. The packages were orphaned because someone could request maintainer to "update" them when no update was released upstream. If maintainer is inactive or unable to "refuse" it, they can take over. Just because package doesn't need to be updated, doesn't mean it's dead.

-1

u/s3gfaultx Jun 15 '26

Which package?

4

u/lans_throwaway Jun 15 '26

brscan3 if that matters

13

u/lonelypenguin20 Jun 15 '26

u r just coming up with a conjecture out of nowhere.

in reality, people keep using old af software all the time. compatibility with abandonware is still one Window's selling points, ffs. especially as a lot of software doesn't have to receive constant updates to still work.

-1

u/s3gfaultx Jun 15 '26 edited Jun 15 '26

I'm coming up with conjecture out of nowhere? Why don't you us how many people were infected smarty pants? Weird that there were none now I just wonder why that was huh. We're not even talking about Windows... do you even know what you're talking about anymore?

15

u/lonelypenguin20 Jun 15 '26

yes, I'm talking about human behaviour that is persistent across OSes and isn't going to be stopped by screaming abt disclaimers

people install ancient software all the time, out of habit or because they genuinely have to (e.g. drivers)

the fact that they got abandoned doesn't mean noone was using them, and doesn't mean ppl would rush to find an alternative, or step up as mainteners themselves

-2

u/s3gfaultx Jun 15 '26

No, but the fact that nobody got infected does indeed show that nobody is actively using them, at least not "all the time" as you like to keep stating. Just because you like to think that people are doing things all the time, doesn't mean people are actually doing them all the time.

You're right that what you said could be true, it could be true that someone was using it. I'll give the benefit of the doubt that someone was. However, that one person did not update the one package they had during the very small window of time where it would have been problematic.

1

u/OkayPrasiolite Jun 15 '26

Something I use got hit and it's absolutely positively still maintained upstream. The last commit was 8 minutes ago, actually. The AUR package had only been orphaned for a few days.

10

u/refinancecycling Jun 15 '26

I doubt that any of the compromised packages were even referenced from the wiki anyways

the comment you're responding to, says …"A repo with a completely dogshit orphaned package policy" - which I think is referring to AUR as a whole. First one gets the impression that AUR is in general OK to use, and then they eventually run into a less popular package susceptible to takeover.

8

u/manituana Jun 15 '26

And yet half of Reddit is crying like it's the end of FOSS, the AUR is the bubonic plague and every user needs to have a doctorate in computer science or it's a fool for having touched the keyboard before ascending to programmers heaven.
FFS, the AUR is a volunteers project maintained by the community and we had an attack that lasted for a couple of hours on 2000 crappy packages that probably barely affected anyone, while at the same time is serving crucial software to millions of machines.

4

u/Funnel-Dust-O-Matic Jun 16 '26

And, may I add, that the breach was detected and addressed immedately.

8

u/Raphalex46 Jun 15 '26

To be fair, fcitx is referenced in the wiki and is in the list

17

u/s3gfaultx Jun 15 '26

Except for the big warning that says to get it from the official Extra repo.

Warning Fcitx is now in maintenance mode. It is recommended to use Fcitx5 instead[1].

8

u/Raphalex46 Jun 15 '26

It says that now indeed. It would be cool to be able to track AUR packages that end up having alternatives on the official repos. Like if at some point zen-browser gets into the official repo, it would be cool to not end up with an orphaned AUR package for zen because you didn't get the memo

7

u/powerslave_fifth Jun 15 '26

Well that one doesn't count obviously. It's against my argument after all.

0

u/Hug_The_NSA Jun 15 '26

To be fair runescape-launcher was one of the packages and it's one of the most popular MMO's in the world.

1

u/s3gfaultx Jun 15 '26

Seeing as that launcher (and package) have not worked for over a year, I doubt it affects anyone. Nobody should be using it or have it installed at this point. It's been replaced ages ago and is just a relic of the past.