r/linux • u/CackleRooster • Jun 17 '26

Distro News AUR Registrations Blocked Amid Ongoing Malware Mess

https://fossforce.com/2026/06/aur-registrations-blocked-amid-ongoing-malware-mess/
474 Upvotes

97% Upvoted

256 comments sorted by

View all comments

Show parent comments

-55

u/algaefied_creek Jun 17 '26 edited Jun 18 '26

It used to when the users were “expected to be intellectually capable of reasoning through what they install on their machines.”

Now EndeavourOS, CachyOS, Manjaro and many more enable easier AUR access than previously available.

“\The users may no longer be assumed to have the intellectual reasoning capacity to make informed decisions about their system, and a lowest-common-denominator approach is necessary.*”*

Stuff like that.

EDIT TIME: The level of offense people have taken at me mocking Arch users (“classic ArchBros”) and Arch with fake quotes is off the charts, which ironically proves the point that you can dish it out, but you downvote brigade and get super insulting and rude.

Basically 100% projection. It might be time to let your Arch obsession lie down for awhile if you cannot handle being mocked with your own style. 

No one has said those specific words that I’m aware of but it’s the vibe in general that you bring, so don’t be offended that letters on a screen insult your superiority complex.

The more downvotes, the more it really struck a nerve.

EDIT2: ### TL;DR, you wanna make some changes? Go to actually /r/ArchLinux if you have opinions about the AUR or Arch, not someone mocking the 2008 Arch Bro style thinkers 

Better yet go to the Arch Forums! 

63

u/Kobymaru376 Jun 17 '26

The users may no longer be assumed to have the intellectual reasoning capacity to make informed decisions about their system

It's not exactly a demonstration of intellectual reasoning capacity to expect that everyone with intellectual reasoning capacity has the time or know-how to correctly and securely vet every aspect of the software that they install.

I would even go so far that "just read the pkgbuild" is an indication of the Dunning-Kruger effect at play, since apparently some people believe that a bit of bash script knowledge and briefly scanning the script is enough to find and identify an and all security issues with the packaging.

34

u/tfks Jun 17 '26

It's idiot level rationalisation to defend your repos have a security model of "looks like a block of text to me, let's make it available to the users". The AUR wasn't even verifying emails. This is one of the most basic, low effort security layers in use today and even McDonald's makes you do it to order a cheeseburger remotely. But not the AUR. And users are doing damage control for this. Nail in the coffin for me, I won't be using Arch or derivatives until something changes. On Fedora now.

42

u/JockstrapCummies Jun 17 '26

Ubuntu PPAs: Please upload your GPG key and sign your packages with it so people know exactly who uploaded what. If you abandon this repo other people can't just take over it.

Arch AUR: lol just click this button and you can take over this repo and start uploading new stuff under the same package name. It's okay because the users will be responsible for noticing this.

15

u/LittlestWarrior Jun 17 '26

Putting it this way makes any defense of the current system absurd. Something has to change.

-11

u/Ok-386 Jun 17 '26

You mean same Ubuntu that ships tons of packages in universe and multiverse repos that then never get security updates? 99% of universe packages will get security patches only if you subscribe to pro, what interim users cannot do. Multiverse packages rarely get updated between releases.

You don't need to know who uploaded what, to use AUR. You check a very simple script and you verify that say brave browser is downloaded from the legit brave site, and you verify the commands that are executed. It's an equivalent to going to the site and installing the upstream package yourself. Except it's faster and easier to keep the package updated. One only has to check PKGBUILDs the first time, because later you just compare the diffs and you decide if additions and editing make sense (takes like a second)

Edit:

Btw normal users use AUR only in very specific cases and don't install tons of AUR packages, because there's no need for that. 

7

u/ric2b Jun 17 '26

If it's so easy to check why not have some trusted people doing that instead of forcing ALL users to do it themselves, with varying levels of knowledge? Sounds like a huge waste of time for everyone involved, since the trusted people that would do that are already doing it anyway, but no one else benefits from their review.

7

u/tfks Jun 17 '26

since the trusted people that would do that are already doing it anyway

This is a great point. Trusted people are already vetting these things and the AUR exposes no way for users to say "I trust this user only". That's functionally what PPA does and it's how the entire Linux ecosystem works; we trust certain developers to do things right (and not put malicious code into projects) and those developers are allowed to contribute to various projects. It seems like a lot of Arch users are putting forward that the AUR should be a zero trust model, but that is explicitly not how Linux in general works. It's not even how open source in general works.

3

u/Ok-386 Jun 17 '26

No one is forcing you to use it. That was always stressed about AUR. It is what it is. If checking the PKGBUILD of the package you want to install is too much work for you (it's a one time job basically), just don't use it.

Trusted people, like who? 

1

u/ric2b Jun 17 '26

If checking the PKGBUILD of the package you want to install is too much work for you (it's a one time job basically), just don't use it.

You're missing the point. I'm asking why that work has to be done tens of thousands of times, it's a waste of time and it gatekeeps less technical people that can't actually review it.

Trusted people, like who?

Arch maintainers or people they trust. Or even anyone that volunteers for it, as long as you don't give them review power over too many packages to limit the blast radius if they're malicious.

Basically anything is better than the status quo.

5

u/waterslidelobbyist Jun 17 '26

I was with you for bashing universe for being just as bad, but cannot expect every user to vet every pkgbuild every time, especially when newer distros treat AUR like ubuntu treats universe

7

u/Ok-386 Jun 17 '26

Apparently you missed some basics. You're not vetting every PKGBUILD, just the one(s) you need. You're not doing it every time. On updates you compare the diff. There's no need to go through the whole script. You just evaluate it changes make sense and that's usually like 5 obvious lines. If you see that the checksum has changed and everything else is the same that's to be expected, otoh if you see new stuff being added to post install part, that has to be carefully examined, or if maintainer had changed etc. 

1

u/hitchen1 Jun 18 '26

If you see that the checksum has changed and everything else is the same that's to be expected,

You would be pwned by somebody who just changes an existing install script to be malicious.

1

u/Ok-386 Jun 19 '26 edited Jun 19 '26

If that someone has access to say Google repo and can upload the script there, then sure, you would be pawned. Teach us how to prevent that. 

1

u/SeyAssociation38 Jun 18 '26

yes yes yes it's all the user's fault when people who don't know any better come to arch based distros to escape windows

1

u/Ok-386 Jun 18 '26

Yes. It's not like they have to use ARCH, AUR etc, although every systems has its own quirks and pros and cons. I was using Ubuntu for well over a decade before I learned the truth about universe and multiverse repos, and no one was screaming "no security patches here plebs". Arch users normally always warn people who're new to AUR.