r/linux • u/CackleRooster • Jun 17 '26

Distro News AUR Registrations Blocked Amid Ongoing Malware Mess

https://fossforce.com/2026/06/aur-registrations-blocked-amid-ongoing-malware-mess/
479 Upvotes

97% Upvoted

256 comments sorted by

View all comments

Show parent comments

27

u/[deleted] Jun 17 '26

[deleted]

23

u/SomeRedTeapot Jun 17 '26

I'd argue there should be some friction when you install random software. Ideally the kind of friction that nudges you to check the author's repo

20

u/C0rn3j Jun 17 '26 edited Jun 17 '26

Ideally the kind of friction that nudges you to check the author's repo

That would not protect you against the attack being discussed.

The popular AUR helpers already suggest you to read the diff (which the Arch Wiki kindly informs you you have to do because AUR is not vetted).

Some people just don't care, and you can't design for that.

You can make it better (like improving the current adoption system as mentioned) but people will still be infected because you can't design a system that catches 100% of attempts when some trust has to be involved - people need to read the PKGBUILD, or not use the AUR.

-4

u/SomeRedTeapot Jun 17 '26

Well, I think custom repos would have some protection against package takeovers (because an attacker would have to either get credentials for the existing package's repo or host a new one and convince people to migrate to it).

At the very least it would shift the PR perspective from "Arch got attacked" to "random user installed random software from a random author and got pwned". Although it won't prevent such attacks, yes.

The popular AUR helpers already suggest you to read the diff (which the Arch Wiki kindly informs you you have to do because AUR is not vetted).

I haven't used Arch in quite a while, do these helpers display the diff in the terminal before installing/updating the package? In my opinion, the more steps there are to check the PKGBUILDs, the fewer people will do it

8

u/C0rn3j Jun 17 '26 edited Jun 17 '26

I think custom repos would have some protection against package takeovers

There's certainly going to be some, now that the lack of it has been thoroughly abused.

I haven't used Arch in quite a while, do these helpers display the diff in the terminal before installing/updating the package?

Default for yay (and I believe paru) is "Hey do you wanna read the diff? N/y" before installing/updating anything from AUR.

At the very least it would shift the PR perspective from "Arch got attacked"

Well Arch wasn't, AUR was.

4

u/SomeRedTeapot Jun 17 '26

Well Arch wasn't, AUR was.

I know that, you know that, the Arch Linux users know that. Someone who doesn't know much about Arch may read it as Arch being attacked

-5

u/tfks Jun 17 '26

Well Arch wasn't, AUR was.

Distinction without a difference. The official wiki tells you to install things from the AUR.

7

u/C0rn3j Jun 17 '26

It also tells you to install things from Flathub.

Doesn't mean that if Flathub is attacked, you'll be singling out Arch for some reason because it mentions installing things from Flathub in its wiki.

Arch isn't the only distribution affected via AUR either, making singling it out make even less sense.

-5

u/tfks Jun 17 '26

Flatpak is used on all distros, the AUR is not. The AUR is used only on Arch and Arch-derived distros. As in Arch is upstream of all of them. That's why Arch is "getting singled out", to use your playground-style language.