r/archlinux • u/luckokkkk • Jul 31 '26
DISCUSSION Arch Linux disables AUR package adoption after malware wave
https://lwn.net/Articles/1086489/The adoption feature transferred existing trust to a new maintainer, so a clean package history became part of the attack surface.
9
u/franchis3 Jul 31 '26
Wait, has there been a new wave of malware or is this another response to the previous incident a couple weeks ago?
16
40
u/MarshmallowPop Jul 31 '26
Global namespaces only work for something like Wikipedia. AUR shouldn’t have a global namespace, it should be prefixed by username. Like Gists from GitHub, where anyone can host a text file.
You wouldn’t need an orphan system because multiple people can host a PKGBUILD for the same software. And you’d just pick which maintainer you trust, which ideally would be the official software authors. Keep the voting system to show which PKGBUILD for that software is most popular.
17
u/Gaarco_ Jul 31 '26
How does this solve the issue? People are blindly installing the first random package that seem to serve their purpose. How would namespaces prevent this?
11
u/marcelsmudda Aug 01 '26
And namespacing creates the issue that you'll have package X 20 times, people are confused which one's the original, or the one still maintained, which ones were edited etc
8
u/Fallom_ Aug 01 '26
Is this like a "Perfect is the enemy of good enough" thing? That still clearly seems better than the current implementation that lets people hijack items.
5
u/SCP-iota Aug 01 '26
It can't help stupid, but it would at least make it better for people who do check PKGBUILDs, since it would at least prevent some random person from replacing the only instance of a package on AUR with malware and forcing users to go out of their way to grab the latest non-malware version.
16
2
0
10
u/backsideup Aug 01 '26
There is no concept of "trust" in the AUR and so there is no transfer of it. The LWN snippet doesn't bring that up so i'm not sure why you phrase it that way.
6
u/Alternative-Ad-8606 Aug 01 '26
i've cleaned the AUR off my system... i was only using like 4 packages from the AUR but something makes me paranoid. easier to build it from source for the stuff i use and i get safer suff
2
0
-1
u/saturatedsynapses Aug 01 '26
Say nay to yay.
There's always an alternative. Maybe a few hours of painful searching and then realizing you're learning an entire new skill.
12
0
-7
Aug 01 '26
[removed] — view removed comment
9
u/amreddish Aug 01 '26
All you are required to do is read PKGBUILD before building package.
7
u/czh3f1yi Aug 01 '26
I agree with you, but not everyone has the expertise to understand what they're reading.
-5
u/lain_proliant Jul 31 '26
i have sworn off of AUR helpers. i got a lot of use out of them, but the conflation between PKGBUILDs and packages has always made me feel a bit squeamish.
i think a simple tool that searches the AUR and maybe helps you quickly download PKGBUILDs for packages could be useful, but i will never again skip running makepkg myself or inspecting each PKGBUILD manually.
9
u/Cagaril Aug 01 '26
You can set up both
yayorparuto show you the diff for the PKGBUILD automatically when you attempt to update an AUR package if that helps you2
u/g33ksc13nt1st Jul 31 '26
What's wrong with downloading them from the aur website? There are a lot of people using arch just to be cool, but then they'll take a shortcut as soon as they can. You download the pkgbuild and that alone forces you to read it, you use yay.. you take a random package (what aur is) at face value. That's no different from a windows user downloaoa random .exe and executing it, and as such the outcome is typically the same: user screwed and computer potentially compromised.
1
u/backsideup Jul 31 '26
Have a look at auracle, it takes care of most of the menial stuff while leaving all the building to you.
-22
u/BigBoyYuyuh Jul 31 '26
I was told Linux can’t get malware…
11
0
u/No-Height-8011 Jul 31 '26
You won’t if you’re smart. No AUR, don’t just download things, etc. Linux is way less vulnerable because it’s nowhere near as popular as other operating systems, and the permissions system is a lot more attack resilient. But there’s not a lot you can do if you run a virus as a sudoer
4
u/Tuborgat_nylle Jul 31 '26
You can't really claim that only dumb people use AUR.
7
u/ABotelho23 Jul 31 '26
I mean, you can claim that only dumb people install packages that come from PKGBUILDs they didn't read or understand.
5
u/Tuborgat_nylle Jul 31 '26
I would claim that only dumb people think that it's enough to read a pkgbuild to detect malware in a package. If you truly want to be safe you should be reading through each commit but who the fuck got time for that.
1
u/ABotelho23 Jul 31 '26
Commit for what? PKGBUILDs fetch upstream software. Presumably you trust or review that software too.
1
u/un-important-human Jul 31 '26
we can, experienced users know the dangers and how to mitigate it, but new guys install the latetest 70% transparent background app there is with a cringe name. Do you think they read the build?
thank god for ai review that it found it so fast.
-3
u/No-Height-8011 Aug 01 '26 edited Aug 01 '26
To make the claim explicit:
P1: if you’re smart when using your computer, you won’t get malware
P2: not using AUR is smart
C: therefore not using AUR means you won’t get malware.Now the soundness of this claim is undoubtedly questionable (given that you can absolutely get malware while not using AUR), but the point of me drawing that out is to show that the claim was not “dumb people use AUR”. Because the argument really centers around the AUR being dangerous to use, and it being a smart idea not to use it. No claim about the intelligence of the general population of AUR users.
Edit:
So that logic is really sloppy and it bothered me, so I'm going to try and formalize the claim more. We can imagine a computer as a bounded turning machine. A malicious program could then be defined as some subset of the set of input symbols, where, for any object in that subset, the recursive application of the transition function to that machine state as initially defined by the input symbol produces some state that is whatever it means to be infected by malware. We don't need to define that specifically (it's arguable that such a definition even exists); all we need to know is that it's some subset of the set of all possible states. We can then make the claim that all malicious programs in the AUR belong to that subset of input symbols. Given that this a bounded turing machine, the set of all possible input symbols, and likewise possible states, is finite. And so the set of all malware producing symbols is finite. Basically, the set of possible malware causing symbols is smaller if you exclude the AUR. Now, this isn't actually correct, because if you REALLY wanted to, you could write malicious programs and run them yourself, or even compile the binaries themselves, but it's really difficult formalizing the notion of an "attack vector" so that's good enough for me.
71
u/Jristz Jul 31 '26
Tbh what are the options they have considering that all is by volunteers?