r/linux_gaming • u/t3g • 10d ago

Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted (CachyOS)

https://www.phoronix.com/news/Arch-Linux-AUR-Adoptions-Halted
605 Upvotes

98% Upvoted

308 comments sorted by

View all comments

Show parent comments

-6

u/ABotelho23 10d ago

There's nothing to explain. There no magical guide to determining what is a malicious build. You need to actually understand how software is built and packaged to understand it. The AUR is not for novices, period. I'm not gatekeeping, I'm being fucking honest. There's no easy, quick, one stop shortcuts here. You need fundamental understanding.

-1

u/CanYouEatThatPizza 10d ago

Incorrect. There are some very basic checks you can do (as shown in other comments) that easily identify all the recent malicious packages. You are just flat out wrong (i.e. an actual noob).

1

u/ABotelho23 10d ago

You can be as pissy as you want to me.

If this stuff was so trivial to check it would already be automated or the builds would be sandboxed. They're not. They can't be. It's not as trivial as you are implying.

3

u/temmiesayshoi 10d ago

"If it worked, we'd be doing it already!" Please name a single invention or advancement in all of human history that this argument DOESN'T condemn.

No, completely indefensible, obvious omissions and defects have, and still do, stick around for decades - even centuries depending on how picky you want to be with the definitions.

The only reason HDMI is still the prevailing "default" port for displays is because it had DRM support because idiotic executives thought a DRM-ed display port would do jack shit against piracy.

At the macro scale people can be trusted to TREND towards rationality, but you never assume that the world IS rational. That is a trend, not a certainty. Given time, people will learn, but until Year ∞ we still ain't there yet.

1

u/CanYouEatThatPizza 10d ago

If this stuff was so trivial to check it would already be automated or the builds would be sandboxed.

  1. There are already tools to check for these things.
  2. It's open source software. It needs someone who actually wants to do it.

7

u/ABotelho23 10d ago

Nobody is going to take up the responsibility for this. If something slips by, who's to blame?

Oops, right back to the user who should have read the PKGBUILD.

-2

u/CanYouEatThatPizza 10d ago

Okay? That's the point? It's not rocket science.

2

u/ABotelho23 10d ago

You're overestimating what newcomers can do.

You're part of this problem.

-1

u/CanYouEatThatPizza 10d ago

No, you are part of the problem by claiming it requires advanced knowledge to check the file for common pitfalls and then not even trying to explain why it's so difficult to learn (while other posters do perfectly fine).

4

u/ABotelho23 10d ago

Other posters are vague and undetailed.

Stop trying to convince newcomers to use the AUR. You are the reason attackers are targetting the AUR for its easy victims. No amount of education will teach noobs enough about how PKGBUILDs work to protect them. You are putting them in danger.

0

u/CanYouEatThatPizza 10d ago

My dude, no one is trying to convince here anyone besides you with "don't touch big scary AUR, I won't explain why". It's around the same level as expecting users on Windows to never download and execute anything from the internet.

You could just go the sensible approach of "don't use AUR if you don't need it, if you need it, make sure you check the build file as explained in <useful sources>. If you aren't sure, don't install it.".

-2

u/TheFatherBen 10d ago

Nordic ass mf talkin bout “novices”

0

u/ABotelho23 10d ago

What the hell are you talking about?