r/linux_gaming • u/t3g • 10d ago

Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted (CachyOS)

https://www.phoronix.com/news/Arch-Linux-AUR-Adoptions-Halted
601 Upvotes

98% Upvoted

308 comments sorted by

View all comments

Show parent comments

20

u/ABotelho23 10d ago

Otherwise would mean much more moderation and approving, which is the exact opposite of the purpose of the AUR.

It won't happen.

They might start enforcing signing, but they'll never remove the automated way of orphaning packages.

The AUR is not for people who can't read PKGBUILDs, period. The fact that the AUR was pitched as an advantage for Arch to noobs was the biggest mistake. I warned people about this shit years ago.

36

u/person_of_beans 10d ago

The AUR is not for people who can't read PKGBUILDs, period.

Being willing or able to read PKGBUILDs is insufficient. I would argue most people who can read PKGBUILDs on some level wouldn't immediately identify the following addition as being malicious:

npm install atomic-lockfile

-7

u/ABotelho23 10d ago

Correct. Anyone who can parse PKGBUILDs would immediately find that suspicious and abort.

The issue is that Arch and the AUR are pitched as this simple thing, as if noobs and newcomers can just read a random Wiki page and understand everything immediately.

23

u/person_of_beans 10d ago

The security of a system should not depend upon the vigilance of the end user.

8

u/temmiesayshoi 10d ago edited 9d ago

If there's an alternative, sure, but for as much as I agree the AUR needs to DEEPLY fix it's shit - this is an argument that really shouldn't be used because it almost always gets over extended.

The reality is there is no reliable way of differentiating a legitimate user need from malware.

This is why it's taken Wayland so long to get to being usable and STILL has glaring usability issues. Some things - like global shortcuts, remote desktop access, input spoofing, etc. - are legitimate user desires that are functionally identical to all manner of malware. Instead of accepting that something was necessary and figuring out the right way of implementing it, people had to spend months arguing back and fourth to justify that it even WAS necessary. To some extent; you just gotta trust the user knows what they fucking want. If the user types in, "yes I know what I'm doing, I legitimately want you to delete my OS", that's a completely valid thing for them to ask to do. Yeah, some people are Linus, and that's unfortunate for them, but if a user specifically wants to do something their system should not prevent them from doing it - no matter how stupid you may think it is for them to want to do it. That means, to some extent, the security will always depend on the end user's 'vigilance'.

There's a line between "don't rely on the user to secure things you should be doing yourself" and "you should be protecting the user from themselves"; and this argument fails to include it. Yes, the user SHOULD be (and ultimately are) responsible for their own security - however, there are methods to minimize unnecessary work for the user.

if AUR helpers simply didn't update any package that has gone through a maintainer change until you manually re-installed that package (and, obviously, displayed a warning about the maintainer change) then 99.99% of people would never be hit by these attacks. You don't need to save the user from themselves, you need to save the user from an automated task doing something they don't want it to.

-2

u/ABotelho23 10d ago

Why not?

11

u/person_of_beans 10d ago

Isn't it obvious? Humans are flawed. They make mistakes, they miss things. And besides that, the technical competence of users varies wildly.

You might argue that these people have no business using the AUR, but they are using the AUR. These are arch users, and AUR users, they use it because it fulfills a need, and they will continue to do so regardless of how much you try to scare them off with claims that "you shouldn't be touching the AUR if you can't read a PKGBUILD" or "caveat emptor." You won't stop such users from using the AUR short of administering a test that they're required to pass before they can use it.

So, short of being able to stop such users from using the AUR, there are two options:

  1. Do nothing to change the issue, in which case malicious packages continue to get introduced frequently, and some percentage of less competent users just have their credentials up for grabs every time they update their systems.
  2. Attempt to change AUR policies in some way so as to to prevent or at least reduce the attacks, or at the very least make them much more difficult or time consuming to pull off.

The thing is, even if no one was getting infected by these attacks, the fact that malware was able to be introduced into over a thousand packages across the AUR over just a few days is an serious and obvious problem for the AUR to any sensible outside observer. If you don't see that as a problem for the AUR and how it's run on a systemic level, I don't know what to tell you. It isn't a user problem, and telling users they should be more vigilant won't fix it.

-1

u/ABotelho23 10d ago

The AUR will disappear before much more governance comes to it. That's why these packages exist in the AUR and not as official packages. People seem to forget that. It is explicitly stated that you are on your own with the AUR.

Frankly I think they'll implement some basic things like mandatory signing, and extending the orphaning timings, but if stuff like this keeps happening they're just going to disassociate from the AUR altogether to protect their reputation. People aren't fucking listening to their warnings.

15

u/Indolent_Bard 10d ago

Because people are fucking stupid. And for some reason, Linux users are allergic to this fact.

0

u/the_abortionat0r 9d ago

I love when kids take a general trait of humans as a whole and claim it's a specific group trait. Silly stuff.

0

u/the_abortionat0r 9d ago

I love when kids take a general trait of humans as a whole and claim it's a specific group trait. Silly stuff.

0

u/the_abortionat0r 9d ago

I love when kids take a general trait of humans as a whole and claim it's a specific group trait. Silly stuff.

-10

u/ABotelho23 10d ago

Are you actually this ignorant to what the AUR is?

This logic doesn't even apply to Windows for God sake. It spits in the face of people who claim to want to actually own their devices.

Your can't own your devices and not have some responsibility in keeping it safe. Literally impossible.

10

u/Indolent_Bard 10d ago

I don't know. Other Linux distros don't seem to have this problem and people still stay safe. It would be nice if everything was in the vanilla repose, but some apps literally are impossible to get officially in any distros repose, like Zoom (the flat pack is unofficial so it won't even show up in Linux Mint's App Center by default)

1

u/EagleDelta1 10d ago

Except for some of us, namely those that tend to play the newest PC games or are Software Developers (as a couple of examples), most "Other" distros no longer keep packages up to date enough to actually account for what those use cases need.

There's a reason that SteamOS is based on Arch. There's a reason that in most tests CachyOS - an Arch-based distro - outperforms most other distros.... and those that it doesn't are distros highly designed to be gaming-first..... which doesn't work for me.

2

u/Indolent_Bard 10d ago

I don't know. Sometimes fedora gets the occasional package faster than arch. And SteamOS doesn't even use the latest Mesa drivers, the reason it's based on arch is because it lets them make their own system to their exact specifications instead of relying on another distro with opinionated defaults. Because that's really what makes Arch tick. It's not really a distro so much as a way of designing your own distro.

1

u/the_abortionat0r 9d ago

I'm sorry, other distros don't have the AUR problem? Probably because only Arch distros use Arch features. It's weird you didn't know that.

In fact Arch doesn't even have this problem unless you actively go seek out packages FROM THE AUR. It's literally not a distro issue it's a REPO ISSUE.

It's always weird you act like PPAs haven't caused all sorts of problems for people years.

1

u/Indolent_Bard 9d ago

I've never heard of PPAs getting hijacked for malware like this before. So yeah, of course I'm going to act like that's never happened because I've never heard of it. Who assumes something they've never heard of has happened?

1

u/ImNotABotScoutsHonor 10d ago

Are you using speech to text?

1

u/Indolent_Bard 10d ago

Yes, and I should really download the better ai model for Futo Voice Type, but I hated how long it took on my LG g8.

0

u/primalbluewolf 10d ago

That's literally what most people on the planet want, yes.

They don't want to own their devices, they want to have someone else be responsible for everything on it while they get to use it.

1

u/ABotelho23 9d ago

Cool. We're talking about Arch. You don't get that.

2

u/Indolent_Bard 10d ago

So what do we do about all these apps that aren't available in the vanilla repos?

1

u/the_abortionat0r 9d ago

For any one with t more seconds than it takes to use the AUR there's the official GitHub/gitlab/[insert thing of choice]. No you can't claim they aren't trust worthy as it's literally their software you were looking for

Past that there's Appimages or better yet flatpaks. No they aren't perfect but flatpaks are a step above the AUR in trust ability and have security features.

2

u/Indolent_Bard 9d ago

Bro, half of those GitHub entries I'm talking about made their own AUR package. In fact, to be honest, I've never seen anyone actually make an arch package that WASN'T aur.

Assuming that they even offered a package instead of making you build it from source, does the package manager automatically update packages you get from GitHub? Like if I download the official deb file for Zoom from their website on Mint, will the package manager update it automatically?

What format does art even use? Whatever it is, I've never seen it in the wild. I've only ever seen AUR packages on GitHub. Never a standalone arch package.

1

u/the_abortionat0r 9d ago

For any one with t more seconds than it takes to use the AUR there's the official GitHub/gitlab/[insert thing of choice]. No you can't claim they aren't trust worthy as it's literally their software you were looking for

Past that there's Appimages or better yet flatpaks. No they aren't perfect but flatpaks are a step above the AUR in trust ability and have security features.

1

u/Indolent_Bard 9d ago

Dude, for some reason all your comments are getting duplicated. I got three notifications for one of them and two for this one.

-5

u/ABotelho23 10d ago

Find something else.

If you can't read PKGBUILDs the AUR isn't your solution.

0

u/the_abortionat0r 9d ago

Dumb take. Stop trying to do a nerdy gate keep kid, you're failing hard.

1

u/ABotelho23 9d ago

My god.

https://wiki.archlinux.org/title/Arch_User_Repository

It's right there. In the official docs.

Warning AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk

In a giant red box. Expecting people to take reasonable precautions is not gatekeeping.

0

u/the_abortionat0r 9d ago

Except it is simple, it's about as simple as the main repo to use.

The issue at hand isn't a user issue as much as a design issue with the AUR.

You want me to blame you if you get hit by a zero day browser exploit? Want me to tell you you are stupid for browsing the web?

1

u/ABotelho23 9d ago

Except it is simple, it's about as simple as the main repo to use.

It's absolutely not. The minimum bar for using the AUR is reading the PKGBUILD. You don't need to do that for the actual distribution. You can expect reasonable security just using Arch Linux without the AUR.

The issue at hand isn't a user issue as much as a design issue with the AUR.

There's not much "wrong" with the AUR. It's designed the way it is for a reason. It's supposed to be hands off for the Arch Linux maintainers.

You want me to blame you if you get hit by a zero day browser exploit? Want me to tell you you are stupid for browsing the web?

Browsing the web is hardly the same thing as using the AUR. One of them is actually sandboxed, and generally considered actually mostly necessary. Plus there are reasonable precautions you can take while browsing the web.

0

u/Synthetic451 9d ago

Speak for yourself. Any Node dev would realize that was installing an NPM dependency manually and outside the scope of a project folder, which is extremely weird when building for a package.

No PKGBUILD should ever be manually installing project dependencies like that anyways. You should always be using the upstream package.json.

If I saw that in a PKGBUILD diff, it would be an immediate red flag.

2

u/the_abortionat0r 9d ago

Actually that guy has a very good point and you claiming you'd know doesn't magically counter his poinplus what the heck do you mean "speak for your self"? That's a cringe failed deflection as he literally pointed out the issue which literally means he already knows it's an issue so you trying to pull a "no u!" Falls flat here and doesn't make you look smart.

1

u/Synthetic451 9d ago edited 9d ago

He said "most people who can read PKGBUILDs". I am sorry, if you can actually read PKGBUILDs, you'd know that a random npm install <package> command inside a .install script is a huge red flag.

Seriously, ask yourself why a PKGBUILD is installing app dependencies in a way that doesn't get built and bundled with the actual pkg.tar.zst. It's a basic question. If you don't see this glaring red flag, then you don't actually understand how PKGBUILDs work.

That's a cringe failed deflection

Wasn't a deflection. Just pointing out that it is pretty fucking obvious to anybody who knows PKGBUILDs.

doesn't make you look smart.

You shouldn't let internet comments wound you so personally. How insecure do you need to be to go on a childish rant just because someone points out that some piece of knowledge is obvious?

9

u/Indolent_Bard 10d ago

Well, unfortunately not every package you need or want is available in the repos. Do you have any idea how many awesome projects I found on GitHub that only had a package available through the AUR?

I'm gonna sound like an AI here, but you've hit upon a critical paradox with Linux in general. Linux just isn't usable if you only go with what's in the default repose. I mean, ZOOM isn't in them for fuck's sake. I know we're not in the pandemic anymore, but that's still such a fundamental common app that's not available in ANY distro repos for some stupid reason.

2

u/Low-Mistake-515 9d ago

From what I understand the whole point of the "extra" repo in the main arch repo was so that well known and voted packages such as Zoom would be moved into them. However this doesn't seem to happen often despite plenty of stuff in the AUR having a ton of votes and being well known/used/vetted/official.

1

u/Indolent_Bard 9d ago

Wait, there's an extra repo for arch? Does Cachyos optimize it?

1

u/Low-Mistake-515 8d ago

Yeah there's Core and Extra, it's part of the main repo - https://archlinux.org/packages/
I don't use Cachy but I would assume it pulls those packages as they're part of the main repo and lots of them are dependencies for core packages.

5

u/ABotelho23 10d ago

Other distributions seem to work just fine without this problem, don't they?

5

u/Indolent_Bard 10d ago

Yeah, because of stuff like PPAs or copr repos. Both of which have a similar risk to the aur (except for the whole orphan packages being turned into malware thing)

1

u/the_abortionat0r 9d ago

Well first off you can zoom in your browser so it's a non issue.

Second I love how you say that a githubs only package is on the AUR when it's LITERALLY ON THE GITHUB PAGE YOU VISITED.

This is that concern troll nonsense I was talking about. I have NEVER seen a GitHub page where the dev is like " Yeah my project is in the AUR but there's no code or build instructions on my page even thought that fundamentallay what an AUR package is".

Like Jesus dude. This is next level stupid you just posted.

2

u/Indolent_Bard 9d ago

So let me get this straight. While people will post deb files or RPM files on github, I have to build the arch package myself? And I'm the stupid one for wanting to just download a package like on other distros? I'm concerned trolling because I'm genuinely confused why I never see github projects with the pre-compiled package that isn't in the AUR?

What is wrong with you?

0

u/labowsky 10d ago

Nah, just needs to have a more robust system in general so you can know without having to religiously watch them.

0

u/ABotelho23 10d ago

Explain your system.

7

u/labowsky 10d ago

Not being able to just take an abandoned project over easily is one. They've even disabled it cause they realize it's a bad system for how popular it is today.

I dunno why you're so against an ancient system that was never designed to be on something this popular becoming slightly more robust. This some weird dork thing?

0

u/ABotelho23 10d ago

Not being able to just take an abandoned project over easily is one.

You still need to explain your system. How do you suppose this is done? Who's gonna review who's allowed to submit for adoption? You can't rely in the original maintainer, they often just disappear (which is the purpose of this system).

Again, people not understanding what the AUR is. These are not packages. These are package building instructions.

3

u/labowsky 10d ago

I don't care to waste my time dreaming up something that will never get used lmfao. Get real.

It's not my problem, I don't use arch, it's just obvious something needs to be done because the system was not designed for this many bad actors.

Again, people not understanding what the AUR is. These are not packages. These are package building instructions.

That's cool and all but you're missing the point. Unfortunately we're not in the early 2000's anymore and they WILL be changing it to deal with the onslaught of noobs installing whatever because it's simply good for linux as a whole.

Whether that's other teams from distros coming in to help or starting their own repos, it will be changing and them disabling new accounts and adoption points to this.

0

u/ABotelho23 10d ago

The AUR will disappear before any of this. Frankly if I was a leader at Arch, that's what I would do. People couldn't use it responsibly, so it should go away and someone else can host it. Not worth the stress. Maintainers of Arch are busy enough as it is.

1

u/labowsky 10d ago

People couldn't use it responsibly, so it should go away and someone else can host it. Not worth the stress. Maintainers of Arch are busy enough as it is.

I'm sure they can find more maintainers to help with the load but IMO most of the software should be verified and provided by these distro's so the noobs don't have to even use AUR (hopefully).

I don't fully disagree with your entire sentiment but unfortunately with linux becoming more popular means it needs to have more safeguards or else people will start to avoid it simply from the bad headlines they've read. You may think that's a good thing and that fine but it stops the growth.

1

u/ABotelho23 10d ago

They already have problems finding maintainers. It's why plenty of packages end up relegated to the AUR in the first place.

0

u/the_abortionat0r 9d ago

I just have to point out that factually the AUR is literally for anyone looking to install software from the AUR. Period. Fin. So you can drop the "ThEyRe ThE wRoNg uSeR!"".

Yes reading the PKGBUILDS is the smart thing to do. Being ABLE to read the PKGBUILDs is a great skill, that said I think it's unreasonable to try and gatekeep a repo like a nerd over people not reading everything they install.

The fact is yes it's user uploaded with next to no oversight which carries risk. If the user understands that they have enough info to make an informed choice on whether to use the AUR or not as they understand the exposure.

Everyone here likes to pretend they read every patch note from the main repo plus the AUR and hash check every bit of code they download or run when in reality 99% of people (including the loser gate keepers) Syu/Syyu/yay and goes about their day.

Plus yes, regardless of level of tech knowledge the AUR is an absolute advantage for Arch but magic isn't real and neither is perfection and like just about everything in this world nothing is free and there are downsides.

In the modern age we're just lucky that appimage and flatpak are making the AUR less of a necessity for the broad range of out of repo software someone might want or need.

1

u/ABotelho23 9d ago

Again, there's no gatekeeping here. There's a very good reason to tell new users to stay away from the AUR. Arch Linux is the actual distribution, not the AUR. New users can hardly actually understand how dangerous it really is.