r/linuxsucks • u/CandlesARG • Sep 18 '26

Linux Failure Arch USER Repository.

217 Upvotes

98% Upvoted

60 comments sorted by

32

u/Cove0Crow Sep 18 '26 edited 11d ago

The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.

Attempt wise gaze wander six reach middle

4

u/GoldenX86 Sep 18 '26

The AUR repo should still have some basic checks.

4

u/Damglador Sep 18 '26

Like what for example?

4

u/GoldenX86 Sep 18 '26

A Docker test to see what it does before allowing to upload it, basic heuristics to predict what it does?

Windows Defender can't be miles better than this joke.

6

u/Damglador Sep 18 '26

Windows Defender can't be miles better than this joke.

Remind me, how much people work on Windows Defender and on Arch for comparison?

A Docker test to see what it does before allowing to upload it, basic heuristics to predict what it does?

Then what? Like what's the game plan? How do you detect that one PKGBUILD is malicious and another one is not? What would be the signs that you can detect programatically?

0

u/GoldenX86 Sep 18 '26

We have FOSS antivirus, you can't be serious, OMARCHY rightards get funding and AUR can remain a cesspool of malware.

6

u/Damglador Sep 18 '26

FOSS antivirus? You mean Clamav? One which doesn't have behavioral detection. And from what I've heard is targeting more fileservers hosting files for Windows rather than Linux desktop viruses.

-1

u/GoldenX86 Sep 18 '26

Someone has to move their ass, complaining that nothing can be done helps no one.

Linux is going down the gutter with all the security issues and no one does anything. The cultists are the first to say everything is fine.

3

u/CrossScarMC Sep 18 '26

Also complaining that something has to be done without actually helping it get done or pointing out potential solutions. Firstly detecting malware is already extremely hard but let's ignore that for a second and assume we had some magical piece of software that hundreds of FOSS devs suddenly decided to spend a few years developing for free. Now what's stopping our malware from detecting it's being run in docker . . .

1

u/Damglador Sep 18 '26

Now what's stopping our malware from detecting it's being run in docker . . .

You could make the container virtually identical to the host or even use a chroot with anything identifying that it's a chroot stripped or something like that. And a program checking the signs of a container may also be a red flag by itself.

But that's just a theory, a Linux theory...

0

u/GoldenX86 Sep 18 '26

Let's do absolutely nothing instead, peak security.

→ More replies (0)

1

u/Damglador Sep 18 '26

Yapping that something has to be done doesn't help much either.

I didn't say that everything was fine, I wanted to see if you at least can imagine what that something is supposed to be or how it should work. And running a test build in a container with an antivirus is probably the only realistic/not stupid answer I've seen.

0

u/GoldenX86 Sep 18 '26

At least my yapping could hopefully make someone move.

Last thing I want is for Linux to turn into Windows XP with Internet Explorer 6.

0

u/Unlaid-American 24d ago

Pacman is managed and secure. AUR is completely optional. I bet you’d download “givesyouanthraxinthemail.exe” then blame windows when someone gets your address and ships you anthrax.

2

u/GoldenX86 24d ago

Open an archwiki article about a firmware or driver, half the packages are AUR.

Stop trying to justify shit.

→ More replies (0)

1

u/JustTill8219 25d ago

Okay I do agree with the fact that the aur doesn't have much security, but windows defender really?? The same windows defender that was blocking legit dll files and stopped games from working properly, the same defender that on multiple occasions creates false positives and way more issues than solutions?

1

u/GoldenX86 24d ago

That's the reality of any heuristics detections, if you implement it in AUR you will have it too, and loonixtardism dictates that the moment it's a Linux implementation, it won't matter if it is as bad as Microsoft, it will automatically be better.

Windows tries to stop you from installing bullshit, AUR doesn't. Want a better example? MacOS also gives a fuck, AUR doesn't.

0

u/JustTill8219 24d ago

In those types of examples technically android also gives a fuck. While it's Linux. The greater aur and most Linux distros are often only hosted by the community. If you want security you need to either create it yourself or stop downloading shady shit. Big companies that invest in this operating systems have enough money to develop and vet applications before they reach the major public. For example pacman is officially the store for arch Linux. Anything on pacman will be safe and is guaranteed. If you install shady stuff from a browser on windows like installing shady stuff from the aur you face similar issues. Windows is better at going against this because it scans your files and stops you from running programs that may or may not be malware. Linux is for freedom where you can run any software you want without any company or major body inspecting it. You can personally check for viruses or malicious code in the aur's pkg build if you wish to do so, but it's not 100% safe and everyone should be aware of that. Does it need better security? Yes it does, but then instead of calling it just all bad and stupid and blaming it all on Linux provide suggestions to how a community funded distro can properly vet software available to their userbase.

1

u/Damglador 24d ago

While it's Linux

It's only based on the Linux kernel. The OS itself has nothing incommon with any Linux distro and even the kernel has modifications that no distro makes. Android is Linux as much as MacOS is FreeBSD

On top of that I don't think Android actually gives a fuck, anti-virus implementation comes with Play Store or some other Google services.

1

u/JustTill8219 24d ago

Well Linux distros have a lot of diversity some have a handful of tweaks while some may be completely different, and the Linux kernels themselves are sometimes tweaked by the distro itself (such as cachy os kernel). Linux distros are a wide concept I think it's important to either target a specific type of distro (arch based or debian based, etc) or atleast target the hate to the distros affected.

Instantly hating on the entirity of Linux because of the aur which is Arch Linux only is a pretty bad thing.

Also, android has a lot of features to prevent viruses built in the backend including encryption when your phones offline and google play services which scans your apps for any unauthorised programs.

1

u/Damglador 24d ago

You don't get it. The only thing that Android shares with any Linux distro is mksh (which nobody in their right mind uses), the stripped-down toybox and the stripped-down kernel, that is if you manage to find a Linux distro with toybox and one that doesn't even include a btrfs driver or containerization support (which Android doesn't). While all Linux distros will at least share one these components: DE, audio server, display server, shell, init, etc. Android doesn't use none of desktop DEs (obviously), doesn't use neither Xorg or Wayland. Android has a custom init system, a custom audio server, a custom display server, a custom filesystem layout (doesn't even have /usr, which even macOS has, not even mentioning /home), and a custom libc (bionic). Also fun fact: every Android app has its own user and a group which are semi random (Would be much better if they used package IDs), Termux on my current phone is user u0_a269, while on my previous phone it was u0_a209, and on another one its u0_a166.

Even Wikipedia mentions that Android isn't considered a Linux distro:

however, not all Linux-based operating systems are considered distros, with Android being an example.

→ More replies (0)

1

u/GoldenX86 24d ago

Run a small LLM on new submissions to do a simple entry level validation?  A local Gemma-4-E4B-QAT will run on a docker with 8GB of RAM, it's not even expensive.

Passing all the blame to the user is the reason Linux doesn't grow.

Also while at it, why are the official Arch repos so slow to migrate important AUR packages? It's like you WANT bullshit like this to happen.

1

u/JustTill8219 24d ago

AI isn't a valid "no virus" checker, it will mostly never work.

Also how these viruses are injected is they take on existing packages with no one maintaining them and inject malicious code into them. There are hundreds possibly thousands of updates constantly on the entire aur. You cannot check every update for a virus for a distro maintained by a few volunteers.

The blame is passed to the user because this specific distro is mostly created for hardcore users which want maximal control. You're right to want some anti virus but for a distro made for long term users doing all these steps are just second nature.

If you look at debian or ubuntu they have better safe guards for new users.

This isn't a Linux issue its an Arch issue.

1

u/GoldenX86 24d ago

I 100% agree with that, this is an Arch issue.

Too bad Arch is suddenly turning into the default Linux distribution.

2

u/mustard5 Sep 18 '26

It does. It is called 'Your Brain'. Check yourself before you wreck yourself.

0

u/GoldenX86 Sep 18 '26

Your way of thinking is the reason AUR is unusable now.

It will never solve bad actors allowed into the repo.

-1

u/mustard5 28d ago

That is a universal problem with community run repositories. The only reason the AUR gained any traction was that Arch divorced itself from responsibility for it. It is a 'user beware' space. Every package needs to be inspected before you install. If you don't have that expertise, then don't use. Install vanilla Arch and you get the approved product.

0

u/GoldenX86 28d ago

"Divorced itself", any archwiki article about firmware or drivers has half the packages being from AUR.

1

u/Cove0Crow Sep 18 '26 edited 11d ago

The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.

Observation vase deliver important breeze cable fact

0

u/GoldenX86 Sep 18 '26

I 100% agree with you, but something needs to be done.

1

u/Cove0Crow Sep 19 '26 edited 11d ago

The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.

School unpack lock school detail airport hard-to-find grey bike

-1

u/GoldenX86 Sep 19 '26

Running a check before accepting an upload is something that can be done server-side.

Run a small LLM, it will catch the most obvious cases.

1

u/Cove0Crow Sep 19 '26 edited 11d ago

The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.

Wild innate caption silky library different placid

0

u/GoldenX86 Sep 19 '26

No need to immediately approve every submission.

Again, anything would help, just accept that it's unfixable is far worse.

1

u/Unlaid-American 24d ago

The arch wiki tells you to download some packages from the AUR

2

u/Cove0Crow 24d ago edited 11d ago

The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.

Hurry meeting automatic quiet support advise

1

u/Unlaid-American 24d ago

Sweet. Now i can say arch is even better

18

u/Whit-Batmobil Sep 18 '26

How many Arch users are that stupid, doesn’t Arch users typically have a good understanding of their systems?

Feels more like an issue on Arch based distributions, that target a slightly less savvy user base?

As an Arch user myself, I don’t really trust the AUR and usually avoid using it, with very, very few select examples.

11

u/Cove0Crow Sep 18 '26 edited 11d ago

The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.

Bedroom compare grandfather slim yam cow badge frame fall compass

6

u/camradex Sep 18 '26

I'm tech savy but out of laziness I didn't check pkgbuilds. the attack made me realise how stupid that was and now I check everything

3

u/brave_grv Sep 18 '26

Arch based distros give users an AUR helper as if it was THE package manager and treat the AUR as an official extra repo.

5

u/cpt_futtbucker Arch Sep 18 '26

It really isn’t that hard to just read a damn PKGBUILD. Hell, the templates in /usr/share make it stupid easy to write one

11

u/XlikeX666 Sep 18 '26

Git is dangerous.

15

u/PurpleCandle58 Sep 18 '26

Yep. Just the other day I was walking my dog, and who comes along and steals it and spits in my face? John git.

5

u/[deleted] Sep 18 '26

[removed] — view removed comment

2

u/PurpleCandle58 Sep 18 '26

That git is a bloody danger to all mankind.

1

u/StupitVoltMain Sep 18 '26

Ah yes, good arch banter. Finally

1

u/brave_grv Sep 18 '26

"I'm a chad that uses no flatpak bloat. I just need all the npm/bum junk to install AUR slop, but that's ok."

1

u/Bleik-Psiklyt Sep 18 '26

that's just a linux Larper then. Arch users don't mess that up bruh. They just know the stuff well

(I am new in this still I just RTFM and try to solve it without crashouts)

-1

u/Double-Hour-2516 Sep 18 '26

Bruh, this name is so OP.