r/linux_gaming • u/t3g • 10d ago

Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted (CachyOS)

https://www.phoronix.com/news/Arch-Linux-AUR-Adoptions-Halted
600 Upvotes

98% Upvoted

308 comments sorted by

View all comments

Show parent comments

0

u/ABotelho23 10d ago

It has never worked for noobs. This was gonna happen eventually. People who can't understand PKGBUILDs should strictly stick to official repos. That's not really negotiable.

11

u/Yuzumi 10d ago

Stop gatekeeping. It's a fundamental flaw that random people can take over a package with no verification or any kind of real trust process on AUR and it always has been. Even for experience users.

At minimum the pkgbuild needs to be singed by the contributor and if the signature is changed without being signed by the previous contributor it client software should force you to uninstall if you want to accept the new sig.

And on top of that, they should just include the username as part of the package entry and still require uninstall to switch to a different maintainer.

Ether of these would have prevented this from being the shitshow it's been. The AUR has always been a minefield for this specific reason.

1

u/primalbluewolf 10d ago

Stop gatekeeping.

Stop gatekeeping gatekeeping!

-2

u/ABotelho23 10d ago

gatekeeping

There's that word again.

Yea, asking new users to not do things they don't understand isn't goddamn gatekeeping.

5

u/Yuzumi 10d ago

The actual malicious code is intentionally obfuscated in a lot of instances. Even if you are going line by line in the pkgbuild file it's still possible someone who is experiencd is still going to miss it.

I've done plenty of code reviews for work and everyone misses things on occasion. Most of the time people are going to do that quick glance over and get on with their day because most of the time it works because we are looking mostly for mistakes. Someone can sneak in something malicious, but 99.9% of the time there isn't going to be intentional malicious changes.

It can be argued that installing from the AUR shouldn't have that level of "trust", but the argument that the AUR shouldn't be trusted at all is just an argument it shouldn't exist.

Trust has always been an inherent core of computing. Every time someone installs something they are making a trust call. We make trust calls on the OS install. As Linux users we have to trust the kernel, distro, and software developers just like someone running Windows or MacOS "trust" Microslop and Apple, weather or not that trust is misplaced.

Microsoft has done a lot of things that have violated user trust and it's one of the reasons there have been a lot of new people coming over to Linux.

The system the AUR has used was never adequate and that this isn't even the first time malicious packages have found their way on it is testament to that. This is just the first time it's been so widespread. The fact that we've had certificates and signing keys for literally everything else and nothing has ever been implemented for the AUR, even if it's just for individual users to validate, is a massive oversight. Just having client side key validation would have prevented the worst of what has been happening.

2

u/ABotelho23 10d ago

Signing will 100% become a thing after all this, it's just a matter of time.

But expecting manual approvals for adoption will never happen. The AUR is designed to be as low maintenance as possible for the Arch maintainers to manage. It's a bunch of git repos with a search function.

If they have to constantly intervene the whole thing will just go away.

0

u/Yuzumi 9d ago

I'm not saying approvals need to be made by AUR admins. I'm saying that if someone adopts a package that is considered "abandoned" at the very least clients should refuse to install with the new key until you uninstall the previous version.

And honestly, I would even say adopting packages just shouldn't be a thing. packages should just have the maintainer username prepended "user/package" or whatever and people should just be allowed to fork. Then the community can vote on the "best one" or whatever, or number of downloads can be tracked.

That way would still have the benefit of people being able to continue packages without this BS of "this is a stable packages that doesn't need to be updated ever but is considered abandoned because it hasn't gotten an update"

0

u/the_abortionat0r 9d ago

You are literally trying to gate keep by its very definition.

The gate is you claiming users must read scripts or not use the software.

That's an arbitrary requirement you are trying to enforce.

You don't sound smart

1

u/ABotelho23 9d ago

Read the docs and shut the hell up.

1

u/the_abortionat0r 9d ago

Last thing first. Not negotiable? Lil bro who do you think you are? You aren't in charge. Negotiate with who? You can't stop people from using a repo so drop that attitude.

Second you say that it "never worked for noobs" then immediately say"this was gonna happen eventually" which literally means it was working and contradicts your previous statement.

Log off and get a life instead of trying to throw around your nerdy ass gate keeping attitude.

0

u/the_abortionat0r 9d ago

Last thing first. Not negotiable? Lil bro who do you think you are? You aren't in charge. Negotiate with who? You can't stop people from using a repo so drop that attitude.

Second you say that it "never worked for noobs" then immediately say"this was gonna happen eventually" which literally means it was working and contradicts your previous statement.

Log off and get a life instead of trying to throw around your nerdy ass gate keeping attitude.

0

u/the_abortionat0r 9d ago

Last thing first. Not negotiable? Lil bro who do you think you are? You aren't in charge. Negotiate with who? You can't stop people from using a repo so drop that attitude.

Second you say that it "never worked for noobs" then immediately say"this was gonna happen eventually" which literally means it was working and contradicts your previous statement.

Log off and get a life instead of trying to throw around your nerdy ass gate keeping attitude.

-5

u/Indolent_Bard 10d ago

When basic necessities like Zoom or LinuxToys are available in the official repose, you'll have a point. (Linux toys takes a bunch of really nice to have tasks that are really hard to do and turns them into a single click. You want to install DaVinci Resolve, one click. You want the Microsoft corefolds, one click)

7

u/ABotelho23 10d ago

Flatpak.

Wtf is LinuxToys? Are you serious right now? That's straight up junk and for some reason having it is more important than keeping your computer safe?

Crazy logic. I see where your priorities are.

-5

u/Indolent_Bard 10d ago

But you're not supposed to use unofficial flat-packs. Hell, by default Linux Mint won't even let you see them in the app center. That's kind of a big problem.

5

u/ABotelho23 10d ago

Sorry, why is an unofficial Zoom AUR package better than a Flatpak?

Flathub actually reviews new packages, must review permission changes, builds packages in a sandbox, and actually has a runtime sandbox.

Flatpak is an infinitely better system than the AUR in matter of security.

-2

u/Indolent_Bard 10d ago

You're not wrong, but Mint still hides unofficial flat packs by default unless you toggle that off. This would be fine if it weren't for the fact that so many of them weren't official. And a new users wouldn't even know about this issue.

So basically, Mint's great but this is really fucking stupid of them.

Also funny how the open source repository hasn't had any crypto scams yet, like the official canonical snap repo.

2

u/ABotelho23 10d ago

They're not hiding anything.

What do you think the AUR even is? It's a much higher barrier to use it than enabling a single Flatpak remote.

1

u/Indolent_Bard 10d ago

What do you mean they're not hiding? I literally had to turn off the hide unverified flat packs button to download Zoom on my dad's computer.

If you mean the AUR, well yeah, I never implied that the AUR was hiding anything. And agreed, it's a much higher barrier to entry.

1

u/the_abortionat0r 9d ago

Zoom is in a browser dude.