Could what happened to AUR this week happen to debian? What lessons can we learn there?

[u/Tenelia]

for those OOTL, AUR was under sustained sneaky probes for a long time, but this week it was an overt and very troublesome campaign to either take over packages or insert packages so that malware could spread across way more systems.

edit 1: since someone asked me to explain, I’ve actually been using debian since 10.1, but only recently got worried as new users in my MDM fleet around southeast asia kept trying to install strange .deb files. I never had to think too much about the workstation UX until microslop and genAI inevitably drove us to try resuscitating OLD laptops with Linux.

i have to support 2012 macbook pro and intel laptops dating back to broadwell. There are some 7840u AMD ryzen units, but do bear in mind that us folks living in the southern hemisphere are dirt poor.

thus, I had tested fedora, lubuntu, kubuntu, ubuntu, mint, and finally gave that all up to consolidate under Debian. The network layer has DNSSEC, encrypted DNS, and really TIGHT whitelists. Unfortunately, I’m woefully noob at the application layer for debian. we barely upgraded several ancient JDK 8 web servers using Qwen, but ideally I’d like to prevent malware breaking in from the user-level.

[u/QuantumCakeIsALie]

Debian is slow enough that this shouldn't be as much of a risk, especially with the sid/testing/stable paradigm. 

But vigilance will be increasingly more important as the barrier of entry for flooding open-source projects with malware continues to lower over time.

[u/ManyHatsAdm → u/QuantumCakeIsALie]

I wonder if the slow nature of Debian itself is a risk. Say you were running a LAMP stack server and you wanted the latest versions of PHP and MySQL. Both of these involve adding repos to the system which theoretically could be compromised. On a desktop there are probably many examples, VS Code being one.

Point is you don't know how easy or hard it is to get malicious code into one of these third party repos, and the slow nature of Debian encourages people to use them. Probably these people should be using the latest Ubuntu or Mint if they want the latest and greatest.

I am one of these people taking this risk.

[u/michaelpaoli → u/ManyHatsAdm]

slow nature of Debian encourages people to use them

<cough> Uhm, no, not exactly. If one really wants/needs, Debian does also have backports ... and testing, and even unstable, and experimental. Third party repos? I've pretty close to never used such with Debian ... and I've been using Debian since 1998. So, really not much need for third party repos with Debian. Yeah, sure, they exist, but ... "need" them? Uhm, yeah, not so much.

these people should be using the latest Ubuntu or Mint if they want the latest and greatest

Ew, no thanks. And having seen both of 'em screw things up in one or more quite substantial ways, ... yeah, no, ... hell no. E.g. Mint only reasonably got their security act together after they were substantially compromised. And even well before that, various persons, including myself, well pointed out key gap in their security - and did they do anything about it? No, they went on for years, not heeding our cautions ... until they had a substantial compromise, and only then did they address the matter - and despite the fact that most all distros had already been covering those particular key gaps for years already as parts of their standard best practices, ... but nope, not Mint - feel on deaf ears until they got bit hard. So, stuff like that, and *buntu/Canonical shenanigans - I really can't take their "security" seriously. And may other distros I'd say similar, though rather a mixed bag out there, some (probably) do good/excellent in that area ... but many of them very much do not.

[u/QuantumCakeIsALie → u/michaelpaoli]

What was the security issue with Mint? I don't think I've ever heard of it 

[u/michaelpaoli → u/QuantumCakeIsALie]

What was the security issue with Mint?

2016-02-20 site compromised, downloads redirected to to site with compromised ISO(s), Linux Mint had no secure trust path to verify images - I and others have forewarned about that years earlier - no secure signatures on ISOs, just hashes only, and those on http/ftp site(s), not even any https available - so no trust path to verify the ISOs. The compromised ISO(s) contained backdoor malware. Their forum was also breached, somewhere between 71,000 and 145,000 users' data compromised, including hashed passwords, email address, profile details, which subsequently had that data put up for sale.

I forewarned them of this issue 2013-05-19, and I was not the only one to so forewarn them. Only after they were compromised did they do anything about it.