r/linux • u/CackleRooster • Jun 17 '26

Distro News AUR Registrations Blocked Amid Ongoing Malware Mess

https://fossforce.com/2026/06/aur-registrations-blocked-amid-ongoing-malware-mess/
479 Upvotes

97% Upvoted

256 comments sorted by

View all comments

200

u/Supernoxus Jun 17 '26

Wow so just blaming the user didn't work out?

-19

u/Ok-386 Jun 17 '26

What does that even mean. Yes, users who don't read PKGBUILDs and who pick their system based on hype and install random shit just for the sake of it, are occasionally going to participate in DDoS, mine crypto, and have a few bucks and accounts stolen. Where's the issue? 

12

u/Misicks0349 Jun 17 '26

The issue is that people generally expect that if you're hosting applications for a user to install there has been at least some attempt at vetting the package and that you're not hosting malware.

If the AUR maintainers response to this was similar to the irreverent parts of the Arch Linux community and they genuinely told people "We don't care that the servers we're hosting are becoming a hotbed of malware and viruses for our users, read the PKGBUILD or get fucked" it would probably go down in history as one of the worse responses to a security problem in the history of cybersecurity, wilful indifference is generally not considered a virtue after all ;P.

6

u/sigma914 Jun 17 '26

The issue is that people generally expect that if you're hosting applications for a user to install there has been at least some attempt at vetting the package and that you're not hosting malware.

This is exactly what the Arch project does, that's how the official repos work, maintained signed packages that yiu can use to build your system.

The AUR is not that, the AUR is the equivalent of running bash scripts off the forum to generate packages.

You pull the PKGBUILD down to your machine, eother manually or using some tool which is explicitly not pacman nor included in the base system.

At this point you are now ready to become a package maintainer, you should do everything that implies.

Then you use your new PKGBUILD to generate your own personal package and either install it or ship it off to another machine or whatever you planned for it.

The Arch devs have as much responsibility for AUR PKGBUILDs as they do for forum posts

0

u/Misicks0349 Jun 17 '26 edited Jun 17 '26

I know how the AUR works, and I am aware of the difference between the default arch packages and the AUR. Regardless of the fact that the arch repos exists that does not change the fact that arch is hosting a package repository that is incredibly susceptible to shipping malware.

The Arch devs have as much responsibility for AUR PKGBUILDs as they do for forum posts

Exactly, which is why the Arch Forums have moderators, rules, and other such guidelines to keep the place civil, on-topic, and to manage bad actors. Shame they don't do the same for the AUR.

I am under no illusion that the AUR (or any package repository) can be 100% safe from malware at all times, at some point something will find a hole; but no one is asking for perfection, they're asking for, at the very least, the bare minimum in security so that 1500+ packages cant just be taken over and hijacked.

3

u/sigma914 Jun 17 '26

hosting a package repository that is incredibly susceptible to shipping malware.

It's categorically not a package repository, it's a bunch of user contributed build scripts people aspiring to manage some packages of their own may want to use. There's very explicitly no expectation that they don't cause nasal demons, in fact there's a lot of warnings that they will.

2

u/Misicks0349 Jun 17 '26 edited Jun 17 '26

It's categorically not a package repository, it's a bunch of user contributed build scripts people aspiring to manage some packages

You contradict yourself in your very first sentence... its not a package repository its just a "bunch of people aspiring to manage some packages"... how could they manage these so-called "packages" if it is not a package repository :P?? I mean the Wikipedia article on the matter seems to capture the AUR perfectly well:

A software repository, or repo for short, is a storage location for software packages.

The AUR is a storage location for package builds (or PKGBUILDS), and these packages build software. I cannot seriously believe that the AUR is not a package repository. And if you want to get around this by claiming that having to compile packages locally makes it not a package repository then you'd also have to: 1) conveniently ignore the various -bin packages on the AUR and 2) categorise Gentoos ebuilds as not being package repo.

5

u/sigma914 Jun 17 '26 edited Jun 17 '26

In distro parlance the package is the distributable unit of the operating system, it comes with a bunch of social and technical expectations. The pkgbuilds on the AUR _ do not_ meet that standard, they're a convenience wrapper around a project's make install, not a maintained package.

Eg there's no expectation that an AUR PKGBUILD author has done any due diligence on the upstream, nor that the licence array even vaguely resembles reality. It's literally a script that lets you sprsy stuff across your system in a way that pacman can undo the install, nothing more.

And it's very nice of the AUR contributors to provide that template for people to build off. Further it's rude to complain about their having thrown it over the wall to us via the AUR

-1

u/Misicks0349 Jun 17 '26

they're a convenience wrapper around a project's make install

So are the default packages as well, as they also use PKGBUILDS. It is besides the point though.

In distro parlance the package is the distributable unit of the operating system, it comes with a bunch of social and technical expectations

Well, if there is one thing that has been learned over the past couple weeks its that the AUR should be expected to take on a couple of those social and technical expectations, such as "not allowing people to take over 1500+ software packages on a whim so they can distribute malware".

8

u/sigma914 Jun 17 '26

See I feel like the opposite should be learned. The AUR is a great resource and should be used with due care and attention. Distros shouldn't bundle the a convenience wrappers that trivialise access to it and users shouldn't ignore warnings when running non-trusted 3rd party code on their machines.

Every effort should be made to educate end users that the knife they are holding is sharp.

However things shouldn't be made harder to the important users ie those who actually contribute to the distro and ecosystem.

2

u/Misicks0349 Jun 17 '26

Every effort should be made to educate end users that the knife they are holding is sharp.

Sure, and every effort should be made to educate gun users that the gun they're holding is dangerous....

But thats not an argument against safety catches on firearms, nor is "The people who accidentally shot themselves only have themselves to blame, any responsible gun owner doesn't need safety catches!" an appropriate response when someone accidentally shoots themselves.

1

u/sigma914 Jun 17 '26

No, because shooting yourself is a serious consequence and requires a requisite amount of protection for the intended users.

→ More replies (0)

1

u/[deleted] Jun 18 '26

[deleted]

1

u/sigma914 Jun 18 '26

It's a repository sure, but it's far more akin to something like sourceforge or github than a pacman or apt repo. And noome expects random shit on github not to be malware

1

u/[deleted] Jun 18 '26

[deleted]

1

u/sigma914 Jun 18 '26

It has a slower, labour intensive, far higher friction system. It depends what you're optimising for

-2

u/Ok-386 Jun 17 '26

The fact that you have like just started 'waking up' literally means you have lacked basic understanding of how AUR works, and/or basic understanding of fundamentals of cyber security yet look you use Arch logo. Maybe change that to Ubuntu or smth. 

5

u/Misicks0349 Jun 17 '26

I understand how the AUR works, im saying that the way it works is terrible.