6 ms·

Pushes to arch AUR are suspendended right now.

70 points by EbNar 2mo ago

mijoharas 2mo ago
So another active attack? Does anyone have any other details?
- DavideNL 2mo ago
  https://news.ycombinator.com/item?id=49123208 https://news.ycombinator.com/item?id=49123208
  - Retr0id 2mo ago
    That's the already-known attack being implied by "another".
evil-olive 2mo ago
for context, 2 days ago: Arch Linux disables AUR package adoption (https://news.ycombinator.com/item?id=49123208 https://news.ycombinator.com/item?id=49123208)
numeri 2mo ago
Well, I guess I'll avoid updating for the next few days. A bit worrisome that I did so last night. I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over. LLMs make large scale and long-term attacks easy and cheap. You could (and if I was a three letter agency, I would probably do so!) maintain ten thousand packages as three thousand separate "individuals" for years before cashing in the trust you've built up.
- embedding-shape 2mo ago
  > naively and gratefully trust in the armies of volunteer maintainers is over I'm almost scared to ask, did you not even review the PKGBUILD or anything else before installing stuff from the AUR? Nixpkgs has a completed different model compared to AUR, the changes that end up in nixpkgs are all reviewed by maintainers, while AUR is literally free-for-all "anyone can push anything at any time", I don't think you ever could "naively and gratefully trust" AUR in the way you might have been.
  - dijit 2mo ago
    > did you not even review the PKGBUILD or anything else before installing stuff from the AUR? I'd venture most people actually don't review pkgbuild; especially on upgrades. The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. You can even hide nefarious code in the compilation/build steps, Jia Tan style.
    - embedding-shape 2mo ago
      > I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. Sure, that's why when you review the PKGBUILD, and instead of it using the official GitHub organization / domain (which you of course validate) for downloading the binary/source, you don't install it. I agree it's still vulnerable to Jia Tan style attacks, but installing from AUR is essentially "curl http://random-website.com/script.sh http://random-website.com/script.sh | bash", and reviewing a PKGBUILD takes a few seconds, and stop/cancel if something is sus, it's really that easy.
      - fantyoon 2mo ago
        > No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? I would assume essentially everyone? `curl https://random-website.com/script.sh https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from the internet into bash. > reviewing a PKGBUILD takes a few seconds This assumes a naive attack that is easily visible from the PKGBUILD. Unless the attacker makes no effort to hide their activity, the PKGBUILD will look perfectly ordinary while still installing malware.
- skydhash 2mo ago
  I used alpine linux and it looks pretty easy to setup your own repository, including build scripts for packages. I now use OpenBSD and the port systems of the BSD (each are different BTW) make it also easy to add extra software.
- matheusmoreira 2mo ago
  > the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over The maintainers you're supposed to trust are Arch Linux's actual staff made up of package maintainers, formerly known as trusted users. AUR packages are maintained by randoms on the internet. Anyone can sign up and push a package.
- matheusmoreira 2mo ago
  > I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Can't have it both ways. Your packages can come from a small number of trusted individuals who maintain the software distribution. Naturally, this limits your choices to the packages they personally maintain. If you need something outside of that set, you need to ask them to include it or source it yourself. Alternatively, your packages can come from a software repository that allows internet randoms to push literally anything. That expands your selection to all software ever created, which includes malware since nobody's doing the work to filter that stuff out. Arch Linux offers both paradigms. Make an informed decision.
  - numeri 2mo ago
    I agree one hundred percent! Doesn't mean I can't wish I could have it both ways :)
lenerdenator 2mo ago
Sadly, this is the future of a lot of FLOSS development unless people start to see their projects as their legacy instead of a simple hobby or a way to scratch an itch. Once your project obtains any sort of real notoriety, it starts having a blast radius, and you need to have at least some idea of who is pushing what to it when and why. The Linux kernel has a pretty good system of this for the time being with Linus being BDFL. There's governance, there's a standard, and most importantly, there are resources coming in. If your wares are being used by large groups of people you've never met and in ways you cannot possibly imagine, then it's time to start doing the boring paperwork and political parts of managing the community around it, not just pushing commits and adding features.
- matheusmoreira 2mo ago
  Linus gets paid to be a BDFL. Pay me enough and I too will sit down and benevolently dictate things all day long. Until then, the world will have to make do with the blast radius.
  - lenerdenator 2mo ago
    He gets paid because there's a foundation set up to direct resources around kernel development, including his compensation. You can see the fiscal info around that foundation here [0] I know it's boring paper bullsh*t but this is the sort of thing more people need to set up. [0] https://projects.propublica.org/nonprofits/organizations/460503801/201723189349305852/IRS990 https://projects.propublica.org/nonprofits/organizations/460...
    - matheusmoreira 2mo ago
      I'd love to set one up, but I don't think it's enough... That's not the whole story. I bet the actual fundraising is a full time job unto itself. I joined the GitHub Sponsors thing and somwhow got a few sponsors, but it wasn't even close to "quit $DAYJOB and focus on free software" territory. Achieving success here would be a dream come true but even the biggest open source projects aren't making anywhere close to a good individual salary. As the biggest free software project ever, Linux is always the exception.
meribold 2mo ago
The explicit expectation with the AUR has always been that you can't blindly trust the PKGBUILD files. It's more like running an installer from a random website on Windows than it is to using official distro repositories. I think the wiki also always advised against using AUR helper tools that blur the lines between official repositories and the AUR.
- hug 2mo ago
  The Arch wiki explicitly links to the AUR for lots of things, but the prime example is probably the NVIDIA page - https://wiki.archlinux.org/title/NVIDIA https://wiki.archlinux.org/title/NVIDIA - this page is going to be massively viewed, and if you have Pascal or older architecture the suggested driver is from, you guessed it, the AUR. Nowhere on this page does it suggest that the AUR is at all untrustworthy.
DavideNL 2mo ago
Also see: https://news.ycombinator.com/item?id=49123208 https://news.ycombinator.com/item?id=49123208
type4 2mo ago
Practically, is there a better alternative to Arch/AUR? I've used it for years because of the bleeding-edge packages and stability (for me) but with the increased security incidences I don't feel safe. I don't have the time/desire to read the build files of every package I install.
- streb-lo 2mo ago
  Arch is fine, just don't use the AUR unless you are prepared to validate the PKGBUILD. Personally, I only use AUR packages that just wrap binaries from well known sources, the only thing that should change in the diff is the sha256 and the version string which makes re-validating them after an update only take a few seconds.

70 points by EbNar 2mo ago

mijoharas 2mo ago

So another active attack? Does anyone have any other details?

DavideNL 2mo ago
https://news.ycombinator.com/item?id=49123208 https://news.ycombinator.com/item?id=49123208
- Retr0id 2mo ago
  That's the already-known attack being implied by "another".

evil-olive 2mo ago

for context, 2 days ago: Arch Linux disables AUR package adoption (https://news.ycombinator.com/item?id=49123208 https://news.ycombinator.com/item?id=49123208)

numeri 2mo ago

Well, I guess I'll avoid updating for the next few days. A bit worrisome that I did so last night. I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over. LLMs make large scale and long-term attacks easy and cheap. You could (and if I was a three letter agency, I would probably do so!) maintain ten thousand packages as three thousand separate "individuals" for years before cashing in the trust you've built up.

embedding-shape 2mo ago
> naively and gratefully trust in the armies of volunteer maintainers is over I'm almost scared to ask, did you not even review the PKGBUILD or anything else before installing stuff from the AUR? Nixpkgs has a completed different model compared to AUR, the changes that end up in nixpkgs are all reviewed by maintainers, while AUR is literally free-for-all "anyone can push anything at any time", I don't think you ever could "naively and gratefully trust" AUR in the way you might have been.
- dijit 2mo ago
  > did you not even review the PKGBUILD or anything else before installing stuff from the AUR? I'd venture most people actually don't review pkgbuild; especially on upgrades. The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. You can even hide nefarious code in the compilation/build steps, Jia Tan style.
  - embedding-shape 2mo ago
    > I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. Sure, that's why when you review the PKGBUILD, and instead of it using the official GitHub organization / domain (which you of course validate) for downloading the binary/source, you don't install it. I agree it's still vulnerable to Jia Tan style attacks, but installing from AUR is essentially "curl http://random-website.com/script.sh http://random-website.com/script.sh | bash", and reviewing a PKGBUILD takes a few seconds, and stop/cancel if something is sus, it's really that easy.
    - fantyoon 2mo ago
      > No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? I would assume essentially everyone? `curl https://random-website.com/script.sh https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from the internet into bash. > reviewing a PKGBUILD takes a few seconds This assumes a naive attack that is easily visible from the PKGBUILD. Unless the attacker makes no effort to hide their activity, the PKGBUILD will look perfectly ordinary while still installing malware.
skydhash 2mo ago
I used alpine linux and it looks pretty easy to setup your own repository, including build scripts for packages. I now use OpenBSD and the port systems of the BSD (each are different BTW) make it also easy to add extra software.
matheusmoreira 2mo ago
> the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over The maintainers you're supposed to trust are Arch Linux's actual staff made up of package maintainers, formerly known as trusted users. AUR packages are maintained by randoms on the internet. Anyone can sign up and push a package.
matheusmoreira 2mo ago
> I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Can't have it both ways. Your packages can come from a small number of trusted individuals who maintain the software distribution. Naturally, this limits your choices to the packages they personally maintain. If you need something outside of that set, you need to ask them to include it or source it yourself. Alternatively, your packages can come from a software repository that allows internet randoms to push literally anything. That expands your selection to all software ever created, which includes malware since nobody's doing the work to filter that stuff out. Arch Linux offers both paradigms. Make an informed decision.
- numeri 2mo ago
  I agree one hundred percent! Doesn't mean I can't wish I could have it both ways :)

lenerdenator 2mo ago

Sadly, this is the future of a lot of FLOSS development unless people start to see their projects as their legacy instead of a simple hobby or a way to scratch an itch. Once your project obtains any sort of real notoriety, it starts having a blast radius, and you need to have at least some idea of who is pushing what to it when and why. The Linux kernel has a pretty good system of this for the time being with Linus being BDFL. There's governance, there's a standard, and most importantly, there are resources coming in. If your wares are being used by large groups of people you've never met and in ways you cannot possibly imagine, then it's time to start doing the boring paperwork and political parts of managing the community around it, not just pushing commits and adding features.

matheusmoreira 2mo ago
Linus gets paid to be a BDFL. Pay me enough and I too will sit down and benevolently dictate things all day long. Until then, the world will have to make do with the blast radius.
- lenerdenator 2mo ago
  He gets paid because there's a foundation set up to direct resources around kernel development, including his compensation. You can see the fiscal info around that foundation here [0] I know it's boring paper bullsh*t but this is the sort of thing more people need to set up. [0] https://projects.propublica.org/nonprofits/organizations/460503801/201723189349305852/IRS990 https://projects.propublica.org/nonprofits/organizations/460...
  - matheusmoreira 2mo ago
    I'd love to set one up, but I don't think it's enough... That's not the whole story. I bet the actual fundraising is a full time job unto itself. I joined the GitHub Sponsors thing and somwhow got a few sponsors, but it wasn't even close to "quit $DAYJOB and focus on free software" territory. Achieving success here would be a dream come true but even the biggest open source projects aren't making anywhere close to a good individual salary. As the biggest free software project ever, Linux is always the exception.

meribold 2mo ago

The explicit expectation with the AUR has always been that you can't blindly trust the PKGBUILD files. It's more like running an installer from a random website on Windows than it is to using official distro repositories. I think the wiki also always advised against using AUR helper tools that blur the lines between official repositories and the AUR.

hug 2mo ago
The Arch wiki explicitly links to the AUR for lots of things, but the prime example is probably the NVIDIA page - https://wiki.archlinux.org/title/NVIDIA https://wiki.archlinux.org/title/NVIDIA - this page is going to be massively viewed, and if you have Pascal or older architecture the suggested driver is from, you guessed it, the AUR. Nowhere on this page does it suggest that the AUR is at all untrustworthy.

DavideNL 2mo ago

Also see: https://news.ycombinator.com/item?id=49123208 https://news.ycombinator.com/item?id=49123208

type4 2mo ago

Practically, is there a better alternative to Arch/AUR? I've used it for years because of the bleeding-edge packages and stability (for me) but with the increased security incidences I don't feel safe. I don't have the time/desire to read the build files of every package I install.

streb-lo 2mo ago
Arch is fine, just don't use the AUR unless you are prepared to validate the PKGBUILD. Personally, I only use AUR packages that just wrap binaries from well known sources, the only thing that should change in the diff is the sha256 and the version string which makes re-validating them after an update only take a few seconds.