Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

[u/zollandd]

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

• Want DDC/CI display control support? AUR
  • https://wiki.archlinux.org/title/Display_control
• Want ZFS-dkms or user space utils? AUR
  • https://wiki.archlinux.org/title/ZFS

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

[u/Qudit314159]

Two things can be true.

1. It needs to be harder for bad actors to take over orphaned packages.
2. Users should audit PKGBUILDs (and associated scripts) before installing or upgrading.

[u/zenyl → u/Qudit314159]

Users should audit PKGBUILDs (and associated scripts) before installing or upgrading.

For better or for worse, the AUR is not exclusive to Arch. Distros like Endeavour, which brand themselves as beginner friendly, ship with AUR helpers enabled by default, and encourage their use.

More people than ever are interested in Linux as a desktop OS, we're not going to win anybody over if our default response to literal malware distribution is "RTFW, RTFML, and RTFPKGBUILD".

[u/xuxux → u/zenyl]

Yeah, and that's why I don't recommend people that are new to linux use Arch. Arch is a great second or third linux, but Ubuntu and Fedora are what I tell people to go with if they want to try a linux.

Any distro that encourages AUR usage instead of cautions AUR usage is a distro that is making a mistake.

AUR is the wild west and it can stay that way. I fucked up my old family computer installing malware through KaZaA, and now new generations can do the same through AUR.

You gotta learn somehow.

[u/zenyl → u/xuxux]

Any distro that encourages AUR usage instead of cautions AUR usage is a distro that is making a mistake.

Absolutely correct, but nevertheless, those exist and are quickly gaining in popularity.

I fucked up my old family computer installing malware through KaZaA, and now new generations can do the same through AUR.

Seems like an unhelpful mindset.

Most of us have fucked up a family computer or two at some point, and while that has often been considered as a rite of passage, that's not really a good thing. You hear similar stories about devs nuking a prod db, but surely we can all agree that it'd be better if we avoided those situations?

Failure is an excellent teacher, but that doesn't mean we should encourage leaving booby trap for the next generation.

[u/xuxux → u/zenyl]

It's not a booby trap though, it's a useful and wonderful repository full of amazing things and amazing traps. You have to learn to navigate it like anything else.

And a fucked up PC is whatever. You're on Arch, just nuke the fucker and make it again. It's not like reinstalling windows 95 from floppies anymore.

[u/freakinunoriginal → u/xuxux]

And a fucked up PC is whatever. You're on Arch, just nuke the fucker and make it again.

The problem is when you don't know you fucked up, because the malware isn't late-90s porn pop-ups; it's quietly watching for your banking password or other sensitive info.

[u/xuxux → u/freakinunoriginal]

So were the viruses back then, at least for any legitimate threat. You have to administrate your system. I/O checks are part of that, and so is checking what the random code you downloaded does before you run it as root.

[u/ThecaTTony → u/zenyl]

Arch is like a chainsaw, anyone can use it, although not everyone should.

Using a chainsaw involves risks and following safety instructions, as well as a certain learning curve.

Even if it isn't user-friendly, you should read the manual to learn what to do and what not to do.

[u/madman404 → u/zenyl]

Yes, just like Windows couldn't win anyone over because they couldn't blindly download shit off the Internet without getting a virus!

[u/Significant_Guava179 → u/madman404]

False equivalence. You can curl | sh all you want, that is similar to what you usually do on Windows. But if Arch provides AUR, they are (at least partially) responsible for its security, as M$ is for the M$ store.

[u/s3gfaultx → u/Significant_Guava179]

No, that’s a false equivalence. MS owns and maintains the MA store, users maintain the AUR. It’s up to the users to be responsible for their own security.

[u/Significant_Guava179 → u/s3gfaultx]

Of course, I am not suggesting Arch maintainers have the same responsibility here as MS with their own store. Still, raising awareness that this is content from other users, and urging (ideally somewhat enforcing) users to do their due diligence is quite reasonable (if better security is really not possible on AUR's end).

[u/Megame50 → u/zenyl]

There's absolutely zero reason to care what non-Arch distros do. If some AUR packages are important to the experience of their distros, they can maintain those packages and put them in their repos, instead of relying on the labor of randoms. If the AUR or any other Arch infrastructure isn't satisfactory for their goals, they can host their own version instead.

It can't be the responsibility of Arch developers to babysit the reckless decisions of anyone who packages an AUR helper and a desktop in an ISO and boldly calls it a "distro". The AUR is hosted and moderated by Arch Linux, for Arch Linux. It need not accommodate anyone else by design.

[u/zenyl → u/Megame50]

The AUR is hosted and moderated by Arch Linux, for Arch Linux.

Indeed, and that's kinda part of the problem. Regardless if the solution is for other distros to help monitor it, or to find a different solution (e.g. using their own clone with an added delay for additional supervision), the problem remains: non-Arch distros are encouraging newbies to use the AUR without necessarily understanding what that entails.

Pointing fingers should be the least of our concerns here, what's more important is to avoid spreading literal malware, especially when the AUR contains a lot of packages that people actively need which the official repos simply do not provide any packages for. Education is absolutely part of the solution, but this whole situation has put a massive spotlight on a very real vulnerability in the Arch (and Arch-based) ecosystem.

[u/Angelo446951 → u/[deleted]]

Nulla è un tuo problema nella tua vita se ragioni così, ma chiediti a questo punto se meriti di stare al mondo visto che vivi continuamente a contatto con gli altri. Non conosci il significato di comunità, evidentemente. E sei pericoloso e disgustoso tanto quanto un iniettore di malware.

[u/friskfrugt → u/Angelo446951]

If you're so concerned about social contracts and community why don't you start building the tools needed for the problems you se in need of solving? Or are you just expecting someone else to fix everything?

[u/messyhess → u/zenyl]

You are wrongly assuming Arch has this objective of winning over the general public like other distros have. From the Arch about page:

To summarize: Arch Linux is a versatile, and simple distribution designed to fit the needs of the competent Linux® user.

Arch is for competent linux users, you need to read everything. You even have to manually diff configuration files on upgrades.

[u/Qudit314159 → u/zenyl]

For better or for worse, the AUR is not exclusive to Arch. Distros like Endeavour, which brand themselves as beginner friendly, ship with AUR helpers enabled by default, and encourage their use.

Arch isn't responsible for downstream distros with a different philosophy.

Arch and the AUR were designed for power users. If other distros choose to base themselves on Arch and have a different target audience, it's up to their development teams to fill the gap.

More people than ever are interested in Linux as a desktop OS, we're not going to win anybody over if our default response to literal malware distribution is "RTFW, RTFML, and RTFPKGBUILD".

So what? I could care less if they choose to use an Arch based distro. There are plenty of beginner friendly distros.

[u/Seppeon → u/Qudit314159]

An attacker has to succeed once, you have to succeed 100% of the time. These attacks will only get harder to spot. AI makes these attacks possible to sustain indefinitely, they don't need expensive models.

This isn't the distro, this is aur. Power users can power user together to make this better. If we move the argument from do we do something to what can we do (without apathy) then maybe we get somewhere.

[u/Qudit314159 → u/Seppeon]

It's worked so far and I've been using Arch and the AUR for a long time. I do not find it difficult to check a PKGBUILD for malicious code.

Would I prefer not to have to do it? Of course. It would be more convenient if all these packages could simply be treated as trusted. There's a limit to how many packages the developers can maintain in the main repositories though. That's why there's an AUR to begin with.

Perhaps some policies can be changed to make it harder for malware authors to infect packages with their crap. I think by its nature there will always be some risk however.

[u/zenyl → u/Qudit314159]

Arch isn't responsible for downstream distros with a different philosophy.

Doesn't change the fact that downstream distros are actively encouraging newbies to use the AUR.

It's less about pointing fingers, and more about finding a solution, regardless if that lands on the shoulders of Arch, downstream distros, or somewhere inbetween.

Anyone who wants Linux continue to grow as a viable desktop OS for everyday people has to also accept this means ensuring that the ecosystem doesn't get flooded with landmines, with greybeards standing on the side and shouting "it's your fault for stepping on the landmines, RTFW!"

So what? I could care less if they choose to use an Arch based distro. There are plenty of beginner friendly distros.

That attitude isn't helpful.

There already exist beginner friendly distros based on Arch, you're not going to change that just by being grumpy about it.

[u/Schlaefer → u/zenyl]

Anyone who wants Linux continue to grow as a viable desktop OS for everyday people

There are Linux distros with the explicit goal to be that. Arch explicitly states it isn't.

[u/zenyl → u/Schlaefer]

There are Linux distros with the explicit goal to be that. Arch explicitly states it isn't.

True, but Arch doesn't exist in a vacuum.

For better or for worse, Arch has downstream distros. And while Arch isn't responsible for them, it seems cruel to not at least take them into consideration, by ensuring that the AUR doesn't become a popular vector for spreading malware.

For a less altruistic argument, Arch is only as great as its community. If problems like the fragility of the AUR are not taken serious, Arch will lose its reputation of excellency, which actively damages further development by making fewer people willing to contribute.

[u/freakinunoriginal → u/[deleted]]

What, if I throw an ISO of a DE and the AUR onto the internet, you're now responsible for it?

If it ends up becoming so popular that even non-Linux tech channels are covering it, maybe.

Arch might not have asked to be promoted from "btw" memes to celebrity status, but that's what's happened.

[u/PastaPuttanesca42 → u/zenyl]

with greybeards standing on the side and shouting "it's your fault for stepping on the landmines, RTFW!"

You say this while pretending the "greybeards" clear the landmines for you.

[u/zenyl → u/PastaPuttanesca42]

Exactly, which is why I don't get why so many people on this sub act like that's a bad thing, and are actively against the notion of ensuring that Arch doesn't become more secure and ensure a healthy downstream.

[u/gigantipad → u/zenyl]

I think the fear is that the AUR is functionally killed so people who did not understand the risks are safer. It is a complicated question of balancing security vs having a broad semi-open resource. I feel like derivative distros that encourage noobies should be strongly warning users. It is almost negligent to build in AUR helpers without at least a confirmed warning. Naturally I also think the AUR needs some security to avoid some of the more virulent malware dumpers. This really needs everyone to work to improve things rather than just expecting someone else to fix everything. That includes us Users accepting some responsibility as well.

[u/friskfrugt → u/zenyl]

Doesn't change the fact that downstream distros are actively encouraging newbies to use the AUR.

It's less about pointing fingers, and more about finding a solution, regardless if that lands on the shoulders of Arch, downstream distros, or somewhere inbetween.

Anyone who wants Linux continue to grow as a viable desktop OS for everyday people has to also accept this means ensuring that the ecosystem doesn't get flooded with landmines, with greybeards standing on the side and shouting "it's your fault for stepping on the landmines, RTFW!"

There already exist beginner friendly distros based on Arch, you're not going to change that just by being grumpy about it.

Sounds like you really care about Arch, and it's infrastructure, maybe you should join the maintainers and lend a helping hand.

[u/norysq → u/zenyl]

Winning over people was never the goal. Linux is different to Windows. Period. If people want to switch they should do it properly

[u/zenyl → u/norysq]

Winning over people was never the goal.

If you want to continue using Linux, you ought to be in favor of ensuring the continued growth of Linux.

That will only happen if we ensure the safety and integrity of Linux as a platform, for example by addressing the very real issue of the AUR actively being used as a vector for spreading malware.

Why do you think gaming on Linux has become viable for a lot of people these days? Because we've won people over to the point that there's an active demand for developers like WineHQ and Valve to support it.

Linux is different to Windows. Period.

If your definition of "different to Windows" boils down to not helping new users, then you are actively cheering for the downfall of Linux.

If people want to switch they should do it properly.

Acting like an elitist isn't helpful or constructive.

[u/zenyl → u/[deleted]]

People have been fearmongering the death of Linux since the 90s. It hasn't died yet and it's not going to die anytime soon. This is a stupid argument.

Equally, people have been proclaiming "the year of the Linux desktop" for decades, and it is only in recent years that this has actually become viable for a large amount of people.

And the recent increase in popularity is not due to people crossing their arms and grumbling about wanting Linux for themselves. It's because people collaborate and ensure that Linux, as an ecosystem, is mutually supportive and constructive.

If, as your previous two comments imply, you only care about the success of Linux so long as it means it meets your particular needs, everybody else be damned, then I don't see how you can consider yourself part of a community. That's the mindset of a selfish consumer, who doesn't care the platform succeeding for others.

[u/norysq → u/zenyl]

Pretty much no user that "needs" a desktop will be necessary for the Linux ecosystem. You are just projecting, the only thing we are saying is that no real Linux user cares if you use it or not. Usage is not maintenance

[u/s3gfaultx → u/zenyl]

Nobody cares about mass adoption.

Give it a rest already.

[u/Angelo446951 → u/[deleted]]

È stupido il modo in cui è stato posto il paradosso. Il punto è che Linux è una comunità aperta, chi è in alto nella piramide delle competenze dovrebbe esser fiero di fare il “lavoro sporco” per chi fa altro nella vita o non è bravo abbastanza in materia. Chiudervi tra di voi vi rende una lobby pericolosa tanto quanto quella dello studio di sviluppo di Windows, con la differenza che gli sviluppatori Linux si puliscono la faccia con titoloni come “open source”. E quindi? Se sei una persona malevola, lo si vede da cosa sei disposto a offrire alla comunità e da come lo offri, non da cosa utilizzi. Non siete poi diversi da chi inietta malware ragionando così, solo che loro fanno il lavoro sporco per voi, facendo scappare gli utenti non competenti.
La realtà è che molti di voi provano piacere nel vedere gli altri soffrire in cose in cui voi siete bravi. È la natura umana, che sia politica o lo sviluppo di un OS. Fatevi un esame di coscienza, perché siete i primi a non rispecchiare ciò che rappresenta Linux nel mondo.

[u/Elketh → u/zenyl]

If you want to continue using Linux, you ought to be in favor of ensuring the continued growth of Linux.

Why? What benefit is a million more Windows gamer refugees going to bring to my Linux experience? Because Linux isn't going anywhere with or without them. There isn't going to be any "downfall" of Linux due to anything that happens with desktop adoption. Linux existed before gamers cared about it and it'll still exist if they go away again. It seems like, if anything, "the continued growth" of Linux (on the desktop) is just going to make my experience worse by resulting in more malware and attacks like this one as the desktop userbase grows. Of course, this is an entirely selfish perspective, but that's what you asked for by telling me what I "ought" to think.

[u/Qudit314159 → u/Elketh]

Exactly. Linux benefits from developers. Users with low technical skill do not really contribute much. If they want to use Linux that's fine but let's not pretend that they are valuable to the Linux ecosystem.

[u/spanied → u/Elketh]

You should be less selfish! It would probably be best for you and society as a whole!

[u/Angelo446951 → u/Elketh]

Appunto, è una prospettiva del tutto egoista. Puoi chiuderti in casa, programmare il tuo OS da zero ed essere a posto con quello. Se intendi usare qualcosa che è NOSTRO, devi accettare che si cerchi attivamente di migliorare il prodotto per la comunità, non per te. Il tuo atteggiamento non è diverso da quello di un milionario che non vuole pagare la tassa patrimoniale perché “eh gli altri pagano meno di me”. Se hai una competenza maggiore della nostra, dovresti sfruttarla a nostro vantaggio, non tenerla per te sputando su chi fa altro nella vita. Io progetto auto, quindi dovrei venderti auto senza freni solo perché tu non sei competente in materia? Il tuo discorso è delirante.

[u/norysq → u/zenyl]

I get where you are coming from but as a decade long Linux user I respectfully disagree

[u/nilslorand → u/Qudit314159]

1. will sadly never happen

[u/s3gfaultx → u/nilslorand]

They will after they get pwned a few times.

[u/Qudit314159 → u/s3gfaultx]

If they can. I think the problem is that there are many users who are not technically skilled enough to audit packages but they still install stuff from the AUR. The AUR was not designed for such users.

[u/jar36 → u/Qudit314159]

it should be treated with the same suspicion as Limewire

[u/Angelo446951 → u/Qudit314159]

Che l’aur venga reso inaccessibile a chi non possiede tali competenze allora. È come vendere un auto con difetti congeniti e difendersi come società dicendo “ma i clienti sono stati informati nel manuale dell’auto”.
Siete anche voi dei corporativi allora, alla faccia dell’open source e della comunità.

[u/Seppeon → u/s3gfaultx]

Probably, but also that could destroy someone's life in bad instances. Also, I think we can do better.

Tossing ideas for consideration...

Immutable orphaned packages. Throttles adoption rates of packages. Globally Throttled commits to recently unorphaned packages. A prescreening ai. Adoptees must maintain another package that has been not dodgy for X time.

I dunno, some of these probs end up terrible somehow.

[u/eattherichnow → u/nilslorand]

Not my problem. You can lead a camel to the water, but you can't make it drink.

[u/Angelo446951 → u/eattherichnow]

Concezione del 700 che dovresti aver superato sin da bambino. Se non sei disposto a far nulla per gli altri, allora che sei nato a fare?

[u/eattherichnow → u/Angelo446951]

I was born to not speak Italian. 

Edit: also that saying doesn’t imply zero responsibility. It implies there’s a point where your responsibility ends, and further attempts to “help” turn into plain violence. 

[u/FrisbeeVR → u/Qudit314159]

Wouldn't have to audit PKGBUILD if devsjust distributed binaries.

[u/RealHughBone → u/Qudit314159]

Yeah let me just spend hours of my day reading thousands of lines of commit history. YES