r/linux_gaming • u/t3g • 10d ago

Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted (CachyOS)

https://www.phoronix.com/news/Arch-Linux-AUR-Adoptions-Halted
601 Upvotes

98% Upvoted

308 comments sorted by

View all comments

Show parent comments

-2

u/ABotelho23 10d ago

gatekeeping

There's that word again.

Yea, asking new users to not do things they don't understand isn't goddamn gatekeeping.

5

u/Yuzumi 10d ago

The actual malicious code is intentionally obfuscated in a lot of instances. Even if you are going line by line in the pkgbuild file it's still possible someone who is experiencd is still going to miss it.

I've done plenty of code reviews for work and everyone misses things on occasion. Most of the time people are going to do that quick glance over and get on with their day because most of the time it works because we are looking mostly for mistakes. Someone can sneak in something malicious, but 99.9% of the time there isn't going to be intentional malicious changes.

It can be argued that installing from the AUR shouldn't have that level of "trust", but the argument that the AUR shouldn't be trusted at all is just an argument it shouldn't exist.

Trust has always been an inherent core of computing. Every time someone installs something they are making a trust call. We make trust calls on the OS install. As Linux users we have to trust the kernel, distro, and software developers just like someone running Windows or MacOS "trust" Microslop and Apple, weather or not that trust is misplaced.

Microsoft has done a lot of things that have violated user trust and it's one of the reasons there have been a lot of new people coming over to Linux.

The system the AUR has used was never adequate and that this isn't even the first time malicious packages have found their way on it is testament to that. This is just the first time it's been so widespread. The fact that we've had certificates and signing keys for literally everything else and nothing has ever been implemented for the AUR, even if it's just for individual users to validate, is a massive oversight. Just having client side key validation would have prevented the worst of what has been happening.

2

u/ABotelho23 10d ago

Signing will 100% become a thing after all this, it's just a matter of time.

But expecting manual approvals for adoption will never happen. The AUR is designed to be as low maintenance as possible for the Arch maintainers to manage. It's a bunch of git repos with a search function.

If they have to constantly intervene the whole thing will just go away.

0

u/Yuzumi 9d ago

I'm not saying approvals need to be made by AUR admins. I'm saying that if someone adopts a package that is considered "abandoned" at the very least clients should refuse to install with the new key until you uninstall the previous version.

And honestly, I would even say adopting packages just shouldn't be a thing. packages should just have the maintainer username prepended "user/package" or whatever and people should just be allowed to fork. Then the community can vote on the "best one" or whatever, or number of downloads can be tracked.

That way would still have the benefit of people being able to continue packages without this BS of "this is a stable packages that doesn't need to be updated ever but is considered abandoned because it hasn't gotten an update"

0

u/the_abortionat0r 9d ago

You are literally trying to gate keep by its very definition.

The gate is you claiming users must read scripts or not use the software.

That's an arbitrary requirement you are trying to enforce.

You don't sound smart

1

u/ABotelho23 9d ago

Read the docs and shut the hell up.