5 ms·
I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I ca
by WD-42 2mo ago
I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks.
It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?
- charcircuit 2mo agoDesktop Linux has always been a house of cards in regards to security. I agree it's amazing that it went on for so long, but this was inevitable.
- tempfile 2mo agoI disagree. Maintainers for the major distributions take their roles very seriously, and do a very good job generally of filtering out malicious packages. The AUR is an outlier, being essentially an unmaintained wild west.
- saghm 2mo agoThe AUR is also not really comparable to official distribution package repositories either. Yes, it's hosted by the same people as the official repos that are comparable to what you'd get by default on other Linux distros, but it's intentionally not something that works with official package management tooling. The equivalent would be if Debian or Ubuntu hosted a repo that anyone could upload of unbuilt debian packages while explicitly not offering any tooling other than the usual tools for building a .deb from source files that you manually downloaded from anywhere else or defined yourself. It's definitely an outlier, but more in terms of being something that doesn't really exist anywhere else, so of course the security model for it will also be an outlier. That's not an excuse for any security issues, but it's not like Arch doesn't have official repos with maintainers who are just as diligent as any other distro. They just also happen to provide a public git server that people can publish packages to with a UI for seeing some of the package metadata; people could just as easily write toolling to automate package management where it looks for a GitHub repo instead of an AUR one to fetch the build files.
- graemep 2mo agoThe Ubuntu equivalent is PPAs.
- saghm 2mo agoIt's the closest thing, and what gets used in practice for the same purpose, but I'd argue it's not quite equivalent. The equivalent to PPAs in Arch would be putting a custom repository in `/etc/pacman.conf`, which is a thing that is done sometimes (e.g. on SteamOS to provide specific versions of certain software).
- zahlman 2mo agoMore so than, say, Windows? Really? And no, "people using one Linux distro can opt in to possibly getting pwned by each other by making use of a third-party software depot" does not reflect upon the entirety of the Linux world.
- nvme0n1p1 2mo agoIt's funny how these people say Linux security is bad because random people can upload arbitrary files to AUR, but won't say Windows security is bad because random people can upload arbitrary files to Microsoft GitHub.
- tosti 2mo agoMS-Windows gets attacked by the hardware vendors, too.
- davkan 2mo agoI think the wrongful notion comes from the fact that the vast majority of Arch users use and speak about AUR as if it were a part of arch proper, only paying lip service to reviewing PKGBUILDS, etc. They wrap the default package manager in one that supports AUR and never touch it directly again. It feels closer to if all of GitHub was available in one click through the Microsoft store or windows update. And unfortunately that’s how arch is mainly marketed by its users. “Arch has the latest everything, if it’s not in the repos it’s on AUR” is one of the standard selling points. Of course that speaks to how people use linux insecurely not how Linux is insecure.
- thayne 2mo agoMost AUR "helpers" show you the PKGBUILD and/or a diff thereof and ask you to confirm that it looks ok before continuing the install. At least by default. Maybe most users just ignore that and always answer yes without inspecting it. I don't know. But the wiki for the AUR and Readmes for many of these tools have warning banners telling you not to blindly trust AUR packages.
- mindlessg 2mo agoCastles made of sand slips into the sea, eventually
- Matl 2mo agoWith regards to sandboxing etc. maybe. With regards to packages? Official repos support signing and usually rely on maintainers with proven track records. AUR was a honor system and since some people are total basement losers, you can't rely on that.
- Alive-in-2025 2mo agoWe have locks on our doors for a reason. Any software that allows updates and relies on the honor system of "someone else must have checked this" will get hacked. Every day there's yet another certificate or secret stealing infection that is in some random upstream dependency in your dev tools or shell scripts or whatever.
- Matl 2mo agoYes, my point being this isn't some 'Desktop Linux security' hole. This was a known and intentional model of how the AUR operated for decades. Unfortunately it was bound to get exploited like this and so it did.
- thayne 2mo ago> Any software that allows updates and relies on the honor system of "someone else must have checked this" That is never how the AUR was supposed to work. Updates were intended to be a manual process where the user reviewed changes to the PKGBUILD.
- preg_match 2mo agoYes but realistically trust is necessary, as users can’t audit all source code. The fact the source code is even audited is, in it of itself, a blessing. Google Play and the App Store don’t do that, and those are trust based systems as well. And naturally, malware slips through, as it always will.
- Matl 2mo agoThe AUR is not like Google Play. Arch has https://archlinux.org/packages https://archlinux.org/packages for that. The AUR is like an APK from a Reddit post.
- GreenVulpine 2mo agoBetter than the commercial alternatives
- sp0rk 2mo ago> I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux? This has absolutely not ever been the case.
- jolmg 2mo agoIt is, among most users, but it only takes a few abusing that for it to seem like there's none. EDIT: Rereading, maybe it's that other kind of "hacker"...
- sejje 2mo agoyes, hackers are bigger targets imo, not smaller ones
- DDayMace 2mo agoyup there is no honor among thieves unfortunately
- dmitrygr 2mo ago> This has absolutely not ever been the case. I think it was. Eg: on most russian warez forums in the 2000s, it was a bannable offense to crack russian-authored software.
- sp0rk 2mo agoI was just exaggerating for effect. Obviously I wouldn't seriously claim nobody ever did something, just that it wasn't what I would consider common behavior. That being said, I think the particular example you provided is kind of weak. It's my understanding that the behavior you speak of was driven primarily by the Russian government's unofficial policy of ignoring cybercrimes committed by their citizens so long as the targets were not domestic. They were ensuring their ability to continue operation by banning discussion of targeting Russians. This is how groups like the Russian Business Network have been able to flourish.
- dima55 2mo ago[flagged]
- jolmg 2mo agoArch is simply getting popular enough to be targeted.
- hnlmorg 2mo agoIt had been for a long time now. What’s more likely is the effort required for large scale attacks is easier now than ever thanks to LLMs.
- ivanjermakov 2mo agoI'm surprised installing native software is still commonplace. At least in a world of gaming and professional software it's coming from reputable source, but when it comes to PC enthusiasts we've been walking on thin ice for a long time. I also believe this is the main reason why web took off: effortless distribution and sandboxing.
- michaelmrose 2mo agoFor open source software it would be a massive increase in development time, difficulty, and continued costs that dwarf income to switch to the web. It would be shocking if it happened not the reverse. This is just for application software how do you replace installing a library or development tool with the web? It's weird that installing software is weird to you.
- shevy-java 2mo agoCould be AI slop attacks made attacks easier in general. Though, the Arch Linux model was probably never an ideal security model. It seems the easy days of the 1990s are over finally.
- al_borland 2mo ago> I can’t help but feel there used to be honor among hackers. My assumption is these aren't so much hackers, as modern day script kiddies armed with LLMs and too much free time.
- akerl_ 2mo agoI think you've accidentally lumped together "people who work in tech in / around the field of information security" and "criminals". There have been a variety of cultural elements to people doing security research / hacking on their own systems / etc. There has never been "honor" among criminals looking to use technology to steal money or steal things that can be converted to money.
- cookiengineer 2mo ago> What kind of jerk would attack Arch Linux? The answer is: Russians Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely. Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware. [1] https://github.com/cookiengineer/antimiasma https://github.com/cookiengineer/antimiasma [2] https://cookie.engineer/projects/cyber-defense/antimiasma.html https://cookie.engineer/projects/cyber-defense/antimiasma.ht...
- tmtvl 2mo agoOnly ru_RU? It doesn't get disabled with, say, zh_CN, ko_KR, or anything else where the script is outside of the Basic Multilingual Plane (AKA ASCII)?
- inigyou 2mo agoThis is also very common with malware groups that want you to think they are Russian.
- cookiengineer 2mo agoThe comment length is too small to write a thorough malware analysis. That is why I linked my blogposts, the tool, and the whitepaper that I published about it. You have to read it first to come to your own conclusions. If you come to conclusions without reading either of it, there's no point in arguing with you because you made up your mind anyways, and are not interested in learning about malware reversing :)
- static_motion 2mo agoThe reason is popularity. SteamOS is Arch-based and in the hands of a ton of people who aren't necessarily that technical. CachyOS and EndeavourOS have become very popular with the increasing adoption of desktop Linux. The AUR thus becomes an enticing attack surface.
- fooqux 2mo agoI doubt that anybody who is "not that technical" is going to install an AUR package on their steam deck.
- TiredOfLife 2mo agoAll it requires is pasting stuff into terminal. And there are countless guides and videos
- inigyou 2mo agoSo they will disable curl|sh as well?
- PunchyHamster 2mo agowasn't popular but was low entry attack. Now it got more popular but still low entry attack. > It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux? Not sure why hacker would waste their time fiddling with Arch instead of hacking stuff, everything that they need can run just fine on any of the Debian derivatives.
- matheusmoreira 2mo agoPeople are warned countless times that the AUR is unsafe, that any random person can make an account and push packages, that you need to audit what you're downloading and that malware has been discovered in it multiple times in the past.