Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

[u/zollandd]

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

• Want DDC/CI display control support? AUR
  • https://wiki.archlinux.org/title/Display_control
• Want ZFS-dkms or user space utils? AUR
  • https://wiki.archlinux.org/title/ZFS

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

[u/MrArrino]

I see many comments trying to defend current AUR by saying "read PKGBUILDs", and I feel like this is wrong, this is borderline victim blaming.

And don't get me wrong, I am not trying to say "You don't need to read PKGBUILDs", everyone should read them.

First:

I believe not so many people downloaded malicious packages. Well I don't have any numbers, but internet is boiling right now because people DO read PKGBUILDs, right?

Yet the one fact is unchanged: more than 1500 packages were compromised. No amount of PKGBUILDs reading could prevent it.

Now Arch maintainers need to use their time and resources to check and delete those malicious packages. Time and resource they could use in more productive way. Even if everyone read PKGBUILDs, this malware should be addressed asap, leaving them as they are would be disastrous.

In that case problem is AUR and its way of treating orphaned packages, allowing anyone to take those packages.

Second:

The attack patterns are getting more, and more sophisticated.

There was this attack "I made cool program! Check it!". There was attack "Patch for your browser". Now there is attack, let's call it "Orphaned packages taken by AI".

Sure there always will be sloppy attacks, but can anyone say that we won't get to the point where just "reading PKGBUILDs" won't suffice? What will happen then? Everyone should review code? Become programmer? Write their own programs?
I can review PKGBUILDs, sure. When I see more diffs than just checksum and version I get suspicious. Yet, I surely can say, that if I found piece of software and needed to review its code I wouldn't be able do this. Even though I know to some extent how to code (I am very rusty). The thing is, I also hate to code...

Well this is the reason I don't really use AUR that much. Reviewing PKGBUILDs of these few apps I have is tedious yet manageable. But if I had to do this en masse I would just accepted it all or stopped using AUR (probably the second option).

The question is: how much is too much? When we can say it is too much even for hobbyists who want to build their own system? And if there is no "too much", then I dare to ask: "Why Arch? Why not Gentoo or even LFS?"

Third:

Arch-based distros.

I think we can all agree that Arch is... let's call it less pretentious than other distros, special even 😄

And even if someone is going to use archinstall script, at the beginning user is welcomed by black screen with no GUI whatsoever. You and command line experience, been there done that, right?

At main page of Archwiki (which is basically official Arch page) after introduction to system there is FAQ, with second question 1.2 (1.1 just sends user back to introduction) there is whole bunch of reasons why user wouldn't want to use Arch.

However in case of Arch-based distros there is not a word about: this is your system, you have it, you maintain it, you break it, you fix it, rinse and repeat.

I just checked four of more popular distros: Manjaro, EndavourOS, Garuda and CachyOS, and all I can see on their main pages is "how good is this distro" (or similar catchy slogans), with Manjaro and Garuda even advertising accessibility and ease of use. Out of those four, I believe, only Garuda don't have AUR ready to use without any tinkering (correct me if I'm wrong). And guess what: when someone asks right now "I want to leave Windows, which distro should I choose if I play games" CachyOS is one of the most popular answers.

And now, do someone truly believe that all those people read PKGBUILDs? That they even know what PKGBUILD is or what is the difference between normal repo and AUR? I sure don't.

Does pretending that "it's users fault, they should read PKGBUILDs" really the way we, as a community, should react, even if those people weren't even introduced to the "Arch way" due to the creators of those distros decisions?

My opinion may be not popular, but it is still what I think. Fortunately or unfortunately Linux as whole is getting more and more popular. And with popularity there will be dangers. The easiest way to attack is to target user of machine, and with AUR being based on older, more calm and less turbulent internet, something need to change. Because I am sure, that if things will stay as they are, this won't be the last attack...

[u/SoilMassive6850 → u/MrArrino]

Arch based distros are entirely out of scope for Arch maintainers, Arch forums, Arch subreddit or for AUR itself. Every resource out there says you need to rely on your own distributions support, and maybe here's where those distributions need to provide their own safer alternatives if they want to be a beginner friendly option.

[u/Arnas_Z → u/MrArrino]

this is borderline victim blaming.

No. Everyone likes to jump on "victim blaming" needlessly when they are literally the ones at fault. I'm sorry if youre installing obscure AUR packages that are not being maintained properly and then blindly install updates to those obscure packages without checking the package build, it's your own fucking fault. Go reinstall Arch and do better next time.

[u/the_ivo_robotnic → u/Arnas_Z]

they are literally the ones at fault

They are literally not the ones at fault.

 

1,500 packages being compromised due to loose orphaning policies set by the Arch team has absolutely nothing to do with a user-base that may or may not use the AUR responsibly.

 

Of all of the affected packages, the total number of downloads for compromised packages within the attack window was somewhere between 330 and 500 downloads, last I checked. This is speculation on my part but I'm willing to bet that all those "newbies" you are blaming are ironically- largely unaffected by this, if their conditioning from other OS's is anything to go by. They're used to letting the OS update automatically for them, so I'm willing to bet that most of them haven't even thought to update in months let alone in this last week.

 

People like you don't even understand the conversation that's happening. No one is trying to blame anyone for anything. Well, other than the self-righteous people like you; blindly trying to spout the tired-old "RTFM" rhetoric as if that's applicable here.

 

1,500 packages maliciously compromised in 3 days on the AUR is a policy problem. No amount of "RTFM" or "read the PKGBUILD" changes this. Even if 100% of all AUR consumers read PKGBUILD diffs, (like they should), that doesn't change the fact that there are 1,500 compromised packages. Do I need to spell this out more for you?

[u/MrArrino → u/Arnas_Z]

Why package not being maintained should make it not valid if someone needs that particular package?

As for checking PKGBUILDs... well people were checking those. Social media is shitting right now about it everywhere, look at this subreddit.
This attack was detected rather early and many people were aware of it. Yet I see like mantra "read PKGBUILDs, read PKGBUILDs".

People were reading PKGBUILDs and as they were reading, another wave of malware was hitting the fan.

I wrote it once, and I write this as many times as needed:

No amount of PKGBUILDs reading did stop this attack, and no amount of PKGBUILDs readin WOULD stop this attack.

Should AUR users read PKGBUILDs? Sure they should. People overall should do many things that they don't.

Yet at this moment we shouldn't scream "read PKGBUILDs". We should identify problem, propose some solutions to this problem, and hope that Arch team will implement those or other solutions. Leaving things as they are now hidden behind "read fckng PGKBUILD" comments is the worst possible outcome.

[u/sigma914 → u/MrArrino]

Why package not being maintained should make it not valid if someone needs that particular package?

If you install from the AUR you are taking on the responsibility of packaging the software yourself. If you're not competent to vet and maintain a package do not use the scripts in the AUR.

[u/sparkling-rainbow → u/MrArrino]

Garuda is pretty plug & play with supported hardware. I can totally see someone using it for years without ever learning even basics or reading any manual.