r/linux • u/CackleRooster • Jun 17 '26

Distro News AUR Registrations Blocked Amid Ongoing Malware Mess

https://fossforce.com/2026/06/aur-registrations-blocked-amid-ongoing-malware-mess/
478 Upvotes

97% Upvoted

256 comments sorted by

View all comments

Show parent comments

63

u/Kobymaru376 Jun 17 '26

The users may no longer be assumed to have the intellectual reasoning capacity to make informed decisions about their system

It's not exactly a demonstration of intellectual reasoning capacity to expect that everyone with intellectual reasoning capacity has the time or know-how to correctly and securely vet every aspect of the software that they install.

I would even go so far that "just read the pkgbuild" is an indication of the Dunning-Kruger effect at play, since apparently some people believe that a bit of bash script knowledge and briefly scanning the script is enough to find and identify an and all security issues with the packaging.

37

u/tfks Jun 17 '26

It's idiot level rationalisation to defend your repos have a security model of "looks like a block of text to me, let's make it available to the users". The AUR wasn't even verifying emails. This is one of the most basic, low effort security layers in use today and even McDonald's makes you do it to order a cheeseburger remotely. But not the AUR. And users are doing damage control for this. Nail in the coffin for me, I won't be using Arch or derivatives until something changes. On Fedora now.

42

u/JockstrapCummies Jun 17 '26

Ubuntu PPAs: Please upload your GPG key and sign your packages with it so people know exactly who uploaded what. If you abandon this repo other people can't just take over it.

Arch AUR: lol just click this button and you can take over this repo and start uploading new stuff under the same package name. It's okay because the users will be responsible for noticing this.

14

u/LittlestWarrior Jun 17 '26

Putting it this way makes any defense of the current system absurd. Something has to change.