Kerala Linux Community

47 readers

3 users here now

A community for Kerala Linux Users 🐧 Ask questions, share setups, and help each other.

founded 3 months ago

MODERATORS

Crumpled6273@lemmy.ca

Arch Linux: The AUR malicious packages incident continues to happen (www.xda-developers.com)

submitted 2 weeks ago by Crumpled6273@lemmy.ca to c/keralalinux@lemmy.ca

7 comments fedilink hide all child comments

CachyOS provides many packages that are not available in the official Arch repo. But no matter what, I still prefer vanilla arch over anything else... What about you?

top 7 comments

sorted by: hot top controversial new old

[–] brucethemoose@lemmy.world 2 points 2 weeks ago* (last edited 2 weeks ago) (2 children)

Yeah, I’ve cleared out my AUR packages after the first hack.

It’s not worth the risk. Just like I don’t keep npm installed on my machine.

AUR’s period of altruism is over. The cat is out of the bag. Scammers are onto this trend, so now they’re going to keep on hacking AUR accounts in perpetuity.

…In fact, I think AUR needs a dramatic overhaul, or even a depreciation, as its security model just isn’t viable anymore. And Arch (the organization) is in the hook for incidents like this, as the AUR is hosted in archlinux.org.

[–] Crumpled6273@lemmy.ca 2 points 2 weeks ago

Yeah. I think it would be better if Arch Linux added the most used packages in AUR to its official repo. Then we can mitigate the packages abused by threat actors, and Arch Linux users will be more secure from malicious packages.

[–] Dadifer@lemmy.world 1 points 2 weeks ago (2 children)

So what, can we trust the debian repo? Where do we get software from?

[–] Crumpled6273@lemmy.ca 2 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

Debian/Arch official repos fetch software directly from the distro maintainers, while AUR packages can be uploaded by anyone. So theoretically, Debian/Arch repos are considered more secure than AUR packages. Even Flatpaks are also more secure than AUR packages.

[–] Dadifer@lemmy.world 2 points 2 weeks ago (1 children)

How can previously installed AUR packages be compromised, though?

[–] Crumpled6273@lemmy.ca 1 points 2 weeks ago

When the upstream URL gets updated with the malicious uploaders new URL. There is no warning shown in the process; the only way to check it is to inspect the PKGBUILD manually.

[–] brucethemoose@lemmy.world 1 points 2 weeks ago* (last edited 2 weeks ago)

The Debian repo, yeah. Generally.

AUR is particularly risky because anyone can submit software.

But if you heavily rely on 3rd party Debian repos, check out the maintainers, as their security isn’t necessarily on par with the official repo.

…And I can help but think that tons of users do this on Debian/Fedora for non FOSS packages, like Nvidia drivers, certain parts of ffmpeg and such.