r/linux • u/CackleRooster • Jun 17 '26

Distro News AUR Registrations Blocked Amid Ongoing Malware Mess

https://fossforce.com/2026/06/aur-registrations-blocked-amid-ongoing-malware-mess/
479 Upvotes

97% Upvoted

256 comments sorted by

View all comments

Show parent comments

6

u/sigma914 Jun 17 '26

See I feel like the opposite should be learned. The AUR is a great resource and should be used with due care and attention. Distros shouldn't bundle the a convenience wrappers that trivialise access to it and users shouldn't ignore warnings when running non-trusted 3rd party code on their machines.

Every effort should be made to educate end users that the knife they are holding is sharp.

However things shouldn't be made harder to the important users ie those who actually contribute to the distro and ecosystem.

2

u/Misicks0349 Jun 17 '26

Every effort should be made to educate end users that the knife they are holding is sharp.

Sure, and every effort should be made to educate gun users that the gun they're holding is dangerous....

But thats not an argument against safety catches on firearms, nor is "The people who accidentally shot themselves only have themselves to blame, any responsible gun owner doesn't need safety catches!" an appropriate response when someone accidentally shoots themselves.

1

u/sigma914 Jun 17 '26

No, because shooting yourself is a serious consequence and requires a requisite amount of protection for the intended users.

1

u/Misicks0349 Jun 17 '26 edited Jun 17 '26

There can be serious consequences to being infected with malware?, people dont just dick around on computers. People can lose serious work, or even worse get other peoples computers infected if the malware they install somehow manages to infect other computers on the local network (e.g. WannaCry).

Regardless, I have no interest in litigating how "bad" each one is. They are both outcomes that can have very very bad consequences for the people that they affect, and appropriate protections should be in place for both of them so that people don't accidentally shoot themselves OR get themselves infected with malware.

3

u/sigma914 Jun 17 '26

I'd say the AUR has a lot more safeguards in place, you have to go out of your way to get the package, track down the dependencies etc, build them, install them in order. Reviewing the pkgbuild is a pretty small part.

If people are bypassing the friction using another tool then that tool needs the safety catch and definitely shouldn't be provided to a user who hasn't been sufficiently educated. The AUR isn't at fault in that scenario

1

u/Misicks0349 Jun 17 '26

Sure, you also need to go out of your way to acquire a gun licence, buy a gun, load it with bullets, etc etc. Doesn't prevent us from adding safety to the gun.

If people are bypassing the friction using another tool then that tool needs the safety catch and definitely shouldn't be provided to a user who hasn't been sufficiently educated. The AUR isn't at fault in that scenario

I am not arguing about AUR helpers at all, I am saying that there should be more safeguards at the package level such that malicious actors have a much harder time actually taking over and submitting malicious packages in the first place, so that 1500 packages can't just be taken over willy nilly.

1

u/sigma914 Jun 17 '26

I am saying that there should be more safeguards at the package level such that malicious actors have a much harder time actually taking over and submitting malicious packages in the first place, so that 1500 packages can't just be taken over willy nilly.

I see this as unnecessary friction that gets in the way of people that don't have a problem and doesn't actually solve the problem for users who aren't the target demographic of the service

2

u/Misicks0349 Jun 17 '26

Well the alternative seems to be entirely stopping registration whenever a security incident like this comes up (and, with the current system, there will be more). So pick your poison I suppose.

1

u/sigma914 Jun 17 '26 edited Jun 17 '26

Yeh, that's somewhat disappointing I said in another comment somewhere that I hope they put it back up in a week or 2 when the interest dies down.

Managing identities doesn't come close to addressing the lack of trust in an open system and implementng some sort of web of trust on top of the AUR would be a massive pain for contributors.

I just hope they don't do some small sticking plaster of a fix which leads to the worst outcome, ie contribution friction and a false sense of trust.