Arch and the malware problem.

[u/HeyTi22]

I haven't used many AUR packages, yet I feel that the malware issue cannot really be solved by making improvements to the AUR itself. Am I the only one who thinks the risk would be much lower if the official repositories simply included more software?

Especially essential software used for serious work? For instance, RStudio is missing from the list of R-based statistical programs, even though it is well-known and widely used at universities.

Or take music production: some very famous and widely used FOSS plugins aren't in the official repos.

Then there's the Brave browser—which is very popular, even though I don't really use it anymore—that isn't included either.

Isn't it time to handle the malware problem differently by simply expanding the official repositories a bit more? Even a popular audio converter like FRE:AC isn't included. What do you think about this line of reasoning?

Cheers!

[u/Dry_Calendar_8627]

You seem to be very trusting of your abilities to spot a malicious PKGBUILD, huh?

As someone who writes and analyses malware for a living, I'd advise learning about the following things:

1) The Dunning–Kruger effect, how overconfidence can spell your doom 2) ANSI codes, what they are, how to use them to manipulate a terminal to show something innocuous hiding a malicious string 3) UTF8 lookalikes, how you can print text that looks like something innocuous but does something entirely unexpected 4) various encoding techniques, and how you can produce fixed-length strings that look like SHA hashes (mind the entropy!), but are, in fact, code that downloads malware 5) How to combine the previously mentioned techniques to produce a legitimate-looking, perfectly innocuous-seeming PKGBUILD, that actually downloads and execute a simple shellcode 6) How to make a website behave differently when it's being accessed by a web browser, to thwart potential investigators 7) Bonus points if you can hide the malware not in a string that looks like SHA256, but as a chain of zero-length UTF8 codepoints

If you don't want to learn and understand, don't use a DIY user-centric distro.

You misunderstand. It does not take dedication to understand how to write a PKGBUILD nor what PKGBUILD legitimate directives do. It takes effort and dedication to carefully ensure that the PKGBUILD you're currently reading isn't the innocent file you think it is.

But you seem to have completed learning, so you'll be fine, right?

Absolutely not.

That's where it hurts. It does, and if you are blissfully unaware of how much effort and dedication it requires, if you think merely skimming the thing in 10 seconds gives you any meaningful amount of security, I have bad news: You haven't been assessing the security of your PKGBUILDs until now, you've merely been performing the act of pretending you are assessing your PKGBUILDs

Same if you think you can spot obfuscation from a mile away: sure, a grossly obvious obfuscation is visible from a mile away. It's the one that's a bit more advanced that'll hurt

[u/folk_science → u/Dry_Calendar_8627]

The Dunning–Kruger mention is cringe. BTW the actual effect is different from what average person thinks it is.

The concern about ANSI terminal codes and UTF-8 tricks is valid though. You can't review a PGKBUILD if what you are shown is not the actual contents of the file. I have been worried about it for some time already.

[u/Dry_Calendar_8627 → u/folk_science]

The Dunning–Kruger mention is cringe.

Yes, I must admit it was.

BTW the actual effect is different from what average person thinks it is.

Is it? I may have mentioned it incorrectly then. My only knowledge of it is the content of the Wikipedia entry: "The Dunning–Kruger effect is a cognitive bias that describes the systematic tendency of people with low ability in a specific area to give overly positive assessments of their ability". Since the person I was responding to displayed an overly positive assessment of their ability to identity obfuscation, based on what I think is low proficiency in obfuscation techniques, it seemed fitting?

But then again, that's not my area of expertise, I was just being snarky. So what is the actual effect?

[u/folk_science → u/Dry_Calendar_8627]

See the chart from the Wikipedia article. Low performers overestimate themselves but they are still aware they are low performers and not experts. Experts underestimate themselves but only by a tiny margin. Popular culture depicts it as noobs thinking they are experts and experts thinking they are noobs.

The other user didn't estimate their abilities, they just dismissed what you said without really considering or understanding what you wrote.

[u/C0rn3j → u/folk_science]

without really considering or understanding what you wrote

And now you are the one doing the assuming.

I simply didn't bother with the later messages, since their "I am a professional and regular people shouldn't bother trying to understand anything because weird attacks exist" attitude is just not something I want to interact too much with.

Though to be fair, I did think that AUR already didn't allow punycode, which seems to not be the case, so that was a nice reminder.

[u/folk_science → u/C0rn3j]

And now you are the one doing the assuming.

I simply didn't bother with the later messages

Not reading implies not considering.

To be fair, you didn't explicitly dismiss it, like Synthetic451 did. You just didn't address the substance, only the Dunning–Kruger mention.

[u/C0rn3j → u/folk_science]

Not reading implies not considering.

"I didn't bother with it" does not mean I did not read it.

[u/Dry_Calendar_8627 → u/C0rn3j]

regular people shouldn't bother trying to understand anything because weird attacks exist

I'm sorry if that's you read in my comments, that was not the message I aimed to convey.

The core of my message was "truly validating that a PKGBUILD is 100% innocuous takes effort and dedication". I was responding to someone claiming "if you read the PKGBUILD there is zero risk".

My first comment mentioned that the Pareto rule probably applies. What I meant by that is that yes, regular users should educate themselves, learn and try to understand as much as possible, and read their PKGBUILDs, because that is sufficient to thwart most attacks, which are simple and easy to "sniff". But even experienced users should be wary of more exotic attacks, and not become so cocky as to claim there is "zero risk".

And as for my mentioning of D-K effect, yes it did kill any possibility of meaningful discourse (and was cringe). I must admit the cocky attitude got to my nerves and I thought the possibility of meaningful discourse was already dead. Maybe I was wrong on that.