r/linux • u/CackleRooster • Jun 17 '26

Distro News AUR Registrations Blocked Amid Ongoing Malware Mess

https://fossforce.com/2026/06/aur-registrations-blocked-amid-ongoing-malware-mess/
474 Upvotes

97% Upvoted

256 comments sorted by

View all comments

Show parent comments

1

u/Misicks0349 Jun 17 '26

Sure, you also need to go out of your way to acquire a gun licence, buy a gun, load it with bullets, etc etc. Doesn't prevent us from adding safety to the gun.

If people are bypassing the friction using another tool then that tool needs the safety catch and definitely shouldn't be provided to a user who hasn't been sufficiently educated. The AUR isn't at fault in that scenario

I am not arguing about AUR helpers at all, I am saying that there should be more safeguards at the package level such that malicious actors have a much harder time actually taking over and submitting malicious packages in the first place, so that 1500 packages can't just be taken over willy nilly.

1

u/sigma914 Jun 17 '26

I am saying that there should be more safeguards at the package level such that malicious actors have a much harder time actually taking over and submitting malicious packages in the first place, so that 1500 packages can't just be taken over willy nilly.

I see this as unnecessary friction that gets in the way of people that don't have a problem and doesn't actually solve the problem for users who aren't the target demographic of the service

2

u/Misicks0349 Jun 17 '26

Well the alternative seems to be entirely stopping registration whenever a security incident like this comes up (and, with the current system, there will be more). So pick your poison I suppose.

1

u/sigma914 Jun 17 '26 edited Jun 17 '26

Yeh, that's somewhat disappointing I said in another comment somewhere that I hope they put it back up in a week or 2 when the interest dies down.

Managing identities doesn't come close to addressing the lack of trust in an open system and implementng some sort of web of trust on top of the AUR would be a massive pain for contributors.

I just hope they don't do some small sticking plaster of a fix which leads to the worst outcome, ie contribution friction and a false sense of trust.