6 ms·

From the article: "This is yet another incident that showcases that Linux users should not explicitly trust user-controlled repositories." LOL. Why should thi

From the article: "This is yet another incident that showcases that Linux users should not explicitly trust user-controlled repositories." LOL. Why should this only apply to Linux users? We should all be wary of downloading random things from websites. AUR has always been labeled "user submitted", but I guess it's easy to forget that some "users" are really out to cause harm.

21 8y ago
Because there is this myth that only Windows users get infected because Windows is insecure, that packages are vetted, that code being open source means that a backdoor insertion would quickly be discovered, and so on.
- ploxiln 8y ago
  Packages are vetted, in the repos, just not in AUR. They also keep tools that would easily/automatically build and install packages from AUR out of the main repos, to encourage manual handling and individual consideration of AUR package build scripts. Also this malware was found in AUR within a few hours of it going up.
  - xiii1408 8y ago
    Exactly. It's actually kind of a success story for the AUR, since they found the malware so quickly. Of course, it would be more interesting if we could scan or survey the AUR to get a percentage of suspicious packages. I've long been under the impression that some popular AUR packages (e.g. Google Chrome) are pretty safe from tampering. For anything else, I glance over the PKGBUILD to make sure it's not doing anything obviously fishy, and I've never noticed anything.
  - mehrdadn 8y ago
    How are official Arch packages vetted?
    - Foxboron 8y ago
      Depends on what you deem "vetted". Builds from source from a trusted source. Try ask if they can PGP sign their sources. Builds fine. Pushed to the repos. If its an package from core or extra it goes through testing for a few days. Also been a push towards reproducible builds, and the stones have been laid with pacman 5.1.
    - BurningCycles 8y ago
      They are built by the core Arch developers, or as in the case of the 'community' repo, by 'Trusted Users', the latter being people who have done high quality maintaining of packages in the AUR and shown good community involvement. Having met these criterias, they need to be sponsored by an existing TU, and then it will be put up to a vote.
      - mehrdadn 8y ago
        Thank you!
      - heywire 8y ago
        Do you know if there is any kind of review process? For example, let’s say a core maintainer’s machine is compromised and the attacker submits a new package on their behalf. Does anyone else need to review and sign off on the new package?
trash_panda 8y ago
Of course, one should be careful about what one installs on their system. Even more so an Arch user, which should be technical saavy in the first place. Anyways, I know I don't manually review everything I install on my system, I trust the packet manager. I'm not an Arch user so I don't know, but doest the AUR repo have some kind of code signing or automatic analysis of the packages?
- xiii1408 8y ago
  No, AUR packages are PKGBUILD files, which are essentially little batch scripts that run inside a fakeroot. IMHO, the danger of a PKGBUILD itself doing something nasty is small--it would be limited to things like recording `uname -a`, listing all your installed packages: the things mentioned in the article. The real danger is that the PKGBUILD is installing some software, which you will later run with full user privileges. If you don't notice that the Git repo listed in the PKGBUILD file is wrong, you won't notice that you're actually installing a backdoored version of the package.
  - dbrgn 8y ago
    The PKBUILD runs in the fakeroot, but AFAIK the .install files (postinstall hooks etc) run on the host system directly, with root permission. Definitely something you will always want to review. (Also, I don't really get the critique of tools like yaourt, since they make it easy to inspect the PKGBUILD and - if present - install files. The tool simplifies downloading, you still need to review yourself!)
    - xiii1408 8y ago
      All the install hooks are run chrooted inside the pacman install directory. But, yeah, they run as root, so they could still do something nasty at install time. Not when you `makepkg` the PKGBUILD, though.
- vertex-four 8y ago
  The AUR repo is, basically, a free for all. It’s not the official repository, which is trustworthy - it’s just a hosting space for user-provided build instructions.
wyclif 8y ago
Unofficial user repositories contain unofficial user software. Shockers! Sarcasm aside, I think a lot of the pearl-clutching over this incident is down to people not understanding the difference between the official repositories and the AUR.

21 8y ago

Because there is this myth that only Windows users get infected because Windows is insecure, that packages are vetted, that code being open source means that a backdoor insertion would quickly be discovered, and so on.

ploxiln 8y ago
Packages are vetted, in the repos, just not in AUR. They also keep tools that would easily/automatically build and install packages from AUR out of the main repos, to encourage manual handling and individual consideration of AUR package build scripts. Also this malware was found in AUR within a few hours of it going up.
- xiii1408 8y ago
  Exactly. It's actually kind of a success story for the AUR, since they found the malware so quickly. Of course, it would be more interesting if we could scan or survey the AUR to get a percentage of suspicious packages. I've long been under the impression that some popular AUR packages (e.g. Google Chrome) are pretty safe from tampering. For anything else, I glance over the PKGBUILD to make sure it's not doing anything obviously fishy, and I've never noticed anything.
- mehrdadn 8y ago
  How are official Arch packages vetted?
  - Foxboron 8y ago
    Depends on what you deem "vetted". Builds from source from a trusted source. Try ask if they can PGP sign their sources. Builds fine. Pushed to the repos. If its an package from core or extra it goes through testing for a few days. Also been a push towards reproducible builds, and the stones have been laid with pacman 5.1.
  - BurningCycles 8y ago
    They are built by the core Arch developers, or as in the case of the 'community' repo, by 'Trusted Users', the latter being people who have done high quality maintaining of packages in the AUR and shown good community involvement. Having met these criterias, they need to be sponsored by an existing TU, and then it will be put up to a vote.
    - mehrdadn 8y ago
      Thank you!
    - heywire 8y ago
      Do you know if there is any kind of review process? For example, let’s say a core maintainer’s machine is compromised and the attacker submits a new package on their behalf. Does anyone else need to review and sign off on the new package?

trash_panda 8y ago

Of course, one should be careful about what one installs on their system. Even more so an Arch user, which should be technical saavy in the first place. Anyways, I know I don't manually review everything I install on my system, I trust the packet manager. I'm not an Arch user so I don't know, but doest the AUR repo have some kind of code signing or automatic analysis of the packages?

xiii1408 8y ago
No, AUR packages are PKGBUILD files, which are essentially little batch scripts that run inside a fakeroot. IMHO, the danger of a PKGBUILD itself doing something nasty is small--it would be limited to things like recording `uname -a`, listing all your installed packages: the things mentioned in the article. The real danger is that the PKGBUILD is installing some software, which you will later run with full user privileges. If you don't notice that the Git repo listed in the PKGBUILD file is wrong, you won't notice that you're actually installing a backdoored version of the package.
- dbrgn 8y ago
  The PKBUILD runs in the fakeroot, but AFAIK the .install files (postinstall hooks etc) run on the host system directly, with root permission. Definitely something you will always want to review. (Also, I don't really get the critique of tools like yaourt, since they make it easy to inspect the PKGBUILD and - if present - install files. The tool simplifies downloading, you still need to review yourself!)
  - xiii1408 8y ago
    All the install hooks are run chrooted inside the pacman install directory. But, yeah, they run as root, so they could still do something nasty at install time. Not when you `makepkg` the PKGBUILD, though.
vertex-four 8y ago
The AUR repo is, basically, a free for all. It’s not the official repository, which is trustworthy - it’s just a hosting space for user-provided build instructions.

wyclif 8y ago

Unofficial user repositories contain unofficial user software. Shockers! Sarcasm aside, I think a lot of the pearl-clutching over this incident is down to people not understanding the difference between the official repositories and the AUR.