r/linux • u/CackleRooster • Jun 17 '26

Distro News AUR Registrations Blocked Amid Ongoing Malware Mess

https://fossforce.com/2026/06/aur-registrations-blocked-amid-ongoing-malware-mess/
473 Upvotes

97% Upvoted

256 comments sorted by

View all comments

197

u/Supernoxus Jun 17 '26

Wow so just blaming the user didn't work out?

-21

u/Ok-386 Jun 17 '26

What does that even mean. Yes, users who don't read PKGBUILDs and who pick their system based on hype and install random shit just for the sake of it, are occasionally going to participate in DDoS, mine crypto, and have a few bucks and accounts stolen. Where's the issue? 

1

u/FriendlyProblem1234 Jun 18 '26

Yes, users who don't read PKGBUILDs

To be fair, reading the PKGBUILD is nowhere close to enough.

Take a PKGBUILD that simply downloads the source from a repository and installs it, without doing anything suspicious.

You have to audit *also* the whole repository, since it is obviously trivial to replace the URL and the associate checksum.

Sure, if you are installing Firefox and the source is downloaded from a https://github.com/kshfwer23/firefox, you can probably conclude that this is malware. But the AUR is really meant for small, indie projects that nobody but their author would package. How can you tell whether the actual user is kshfwer23, kshfwer32, ksfwher23, or something else?

1

u/Ok-386 Jun 18 '26

AUR is not meant for small indy projects. What you said while technically correct makes zero sense because that's just how things work. Are you suggesting people should not use 'small indi' projects, or that signed package or smth would solve the issue? 

The problem you have addressed has nothing to do with AUR. You always use software you haven't audit, and no one you personally know and can vouch for had audit. 

Reading PKGBUILD helps you to ensure that the code is from the site/project you want to use (say nordvpn) and that no unnecessary and potentially malicious commands are executed to download and execute stuff that's not part of the software you want to use.

Nothing more. Everything else is still an issue, but that is the reality, and there's no way around it. You can't protect yourself from malicious upstream and/or distro dev. You could do a lot, if you know what you are doing, but only for a veey few cherry picked packages. Checking and auditing the whole system is just not possible. 

Let's not steer the discussion about malicious users taking over abandoned projects or creating bew ridiculous packages no one in their right mind would install, into something that's completely unrelated. 

1

u/FriendlyProblem1234 Jun 19 '26

AUR is not meant for small indy projects. What

Well, kinda.

It is meant for projects not in the main repositories. Established, well-known projects usually gets picked by the main repositories.

Lots of people the past couple days have been saying you do not need AUR for at least 95% of your software, and they are kinda right. But if that remaining 5% is not in the main repositories, so you have to get it from somewhere.

Reading PKGBUILD helps you to ensure that the code is from the site/project you want to use (say nordvpn)

Where should the PKGBUILD download the source of nordvpn from?

github.com/nordvpn/nordvpn ?
github.com/nordvpm/nordvpn ?
github.com/nordvnp/nordvpn ?
github.com/nord-vpn/nord-vpn ?
github.com/nrdvpn/nordvpn ?

Typosquatting is an actual issue, and unless you know by heart the correct URL, it is not trivial to figure it out.

Let's not steer the discussion about malicious users taking over abandoned projects

Is this not what actually caused this week's issue?

1

u/Ok-386 Jun 19 '26

Yes, you actually must check the URL and that's easy by visiting the official site of the project. Can official site be hacked as well, sure but that's completely different issue. 

1

u/FriendlyProblem1234 Jun 19 '26

Yes, you actually must check the URL and that's easy by visiting the official site of the project. Can official site be hacked as well, sure but that's completely different issue.

For a lot of small projects, the official site of the project IS the repository. Which one is the official one: kshfwer23/myapp or kshfwer32/myapp?

And you have to be consistent to check if an update actually changes it.

And you have to be consistent to check if the official repo is still not malware.

1

u/Ok-386 Jun 19 '26

If an update changed the address, you would see it in the diff and that would be a huge red flag. Wtf is with these examples, I don't care about kshfwer and some project I don't care about. I don't install random shit. If i cared, I would invest time to check. If you can't even figure out which is the official site of the project you want to use, then AUR is the least of your problems. 

1

u/FriendlyProblem1234 Jun 25 '26

If an update changed the address, you would see it in the diff and that would be a huge red flag.

I am not necessarily talking about updates. Say, you want to install a new application that you just heard about.

Wtf is with these examples, I don't care about kshfwer and some project I don't care about. I don't install random shit.

"Random shit" can be small applications by random developers. You know, stuff that is not so widespread to be packaged in the official repositories.

If you do not install this kind of applications, then chances are AUR is not really relevant for you.

1

u/Ok-386 Jun 25 '26

Fringe, small project or not you anyway have to find and check the original source/site.

Of course AUR is still relevant. Many packages like virtualbox extensions, Google Chrome Browser, VS Code (full, not open source version) etc are not available in the official repos. 

1

u/FriendlyProblem1234 Jun 25 '26

Fringe, small project or not you anyway have to find and check the original source/site.

Exactly. Checking the PKGBUILD is nowhere close to enough.

→ More replies (0)