From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
Also keep in mind that Arch is (differently from FOSS diehard people like Debian maintainers) quite permissive in what it accepts. This might be comfortable to get some hardware running, but with this you get also stuff like Brave Browser in the software directory which, how do I say this, might not be the best choice for privacy.
So,if you want privacy and safety, you should have a good look at what you install.
AUR is not Arch maintainer vetted repo tho. Even librewolf is not in the arch repo.
The closest equivalent of AUR is PPA/launchpad
AUR is not Arch maintainer vetted repo tho.
Oh, of course. I didn't repeat that, because this is is clearly stated in the docs and should be well known now.
The AUR is basically just a shortcut for downloading random shit off GitHub.
It gives un-experienced users a false sense of security.
The AUR is basically just a shortcut for downloading random shit off GitHub.
It gives un-experienced users a false sense of security.
As is "pip install" by the way.
The false sense of security is actually caused by people saying the AUR is the easiest way to safely get all your packages, when in reality the AUR itself tells you to always review PKGBUILDs and to not blindly trust AUR packages.
Maybe someone here can advise. I ran two of the available "checking" scripts to see if I have any packages installed. Both came up with 1 package I have installed. It is gtkimageview, which is on the list.
However, if I look through the pacman.log I see it was installed on 2024-10 and last upgraded 2025-01. It seems to me that suggests I installed it before this all started, so I'm probably not infected?
At this point, the count stands at 1500+ https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
This is why I use NixOS
Guix on top of Arch, replacing most of AUR packages is also a good alternative (with less involvement of US military companies, more context here, and a nice minimalist configuration language).
Both Nix and Guix can be installed on top of Arch and work as an extra package manager.
Plus Guix is a GNU project and GNU projects are both very open to modification and hacking own stuff, and fairly security-conscious.
It has one fly in the ointment: Guix is really not built for distribution of binary packages of closed-source software (all package definitions build initially from source), and that's why some companies hate it. But for me, this is a plus.
Maybe maintenance of packages shouldn't just be handed over to newly created accounts. This is a design flaw on AUR's part. As Linux popularity rises, these types of attacks will just keep growing. There should also be some sort of system where it is easy to verify that the maintainer of the package is also the actual developer. Like brave-bin has brave has the maintainer who are also the creator. Just give a green check mark to them or something.
Or maybe don't use AUR blindly? You're doing the equivalent of `sudo curl
| bash`. Who knows what the script is doing. So only do it if you truly trust it. That's why we have warnings plastered all over. That's also why a warning label and sticker exists. And this is precisely the reason easy no user input AUR helpers are greatly discouraged
That’s why we have warnings plastered all over.
Plastering warning labels everywhere is a cheap way to shift 100% of the accountability onto the user. Security should be built into the AUR's design (throttling new accounts, forcing forks for orphaned takeovers or maintainer-developer verification), not outsource your job to the users as a reading assignment before every system update. Humans are the final layer of defense not the first.
Or maybe don’t use AUR blindly? You’re doing the equivalent of sudo curl
| bash... So only do it if you truly trust it.
There is a massive difference between blindly curling a random script from the open web and using a centralized, organized community repository. Yes AUR helpers are not recommended but they exist and are used by majority of Arch users and you can't expect the user to know code and pkgbuilds especially when distros like CachyOS make it so damn easy to install the OS with AUR being just a checkbox away.
You said it yourself that it is a community repository. No difference between that and the internet forum. You are putting the burden of accountability on the maintainer that way. Which I would remind you, is unpaid unlike say, github and npm that HAS a financial means to do a lot of security implementation. Yet those platforms still fail to do it.
Also, humans ARE the first layer of defense. Because anything you do on your device (on linux anyway, and specifically arch) is YOUR decision. Antivirus and everything else should kick in when the human fails.
You are normalizing people downloading things off the unvetted internet like on windows. Linux has a vetted repo already. THOSE are what people should be using and I'm fine with if those are being blamed. Everything else is USER due diligence. That is why the existence of easily installing malware like limewire does not justify blaming the platform. Or do you also blame torrenting site when they are chock full of malware?
Fine agree with all of what you say. But still the AUR is the only repo where this happens majority of the times. So what to do next? I am sure the solutions I mentioned in a comment below are not that difficult to implement.
Sure, your proposed solution is a good way to weed out the low hanging fruit. But I don't like that it may create friction for normal users. AUR was never meant to be a FOSS project on its own with a full time maintainer that maintains PKGBUILD and the infra.
Like I said before, it is more akin to an internet forum and pastebin more than a full fledged package repository. And to be fair, it isn't a package repo anyway. It's like a cmake / makefile sharing site. Building and packaging for arch is just that easy compared to say, debian.
If people want to use a repo, there is chaotic aur. Maybe that could be the way too. A dedicated community project to vet the AUR. Or the project maintainer itself could provide a pkgbuild directly on their repo.
Just don't ever blame the maintainer for providing a place to store something for free and open to anyone. Especially if it is your choice to get something from said place and be surprised that it is malware.
Maybe maintenance of packages shouldn’t just be handed over to newly created accounts. This is a design flaw on AUR’s part.
That is the whole purpose of AUR, users can create and share packages with minimum fuss. That does not mean that it is a good idea to run the code of some random guy on your computer.
But open source has always worked like that, by code sharing and collaboration - on tapes, on FTP servers, on Sourceforge or github and today on codeberg. The way the Arch User Repository (this is AUR spelled out) makes this easy is great!
Just don't run random code that you don't understand, and cannot reasonably trust.
Just don’t run random code that you don’t understand
I don't understand any code so does that mean I shouldn't use any software? that is 99% of the world.
whole purpose of AUR, users can create and share packages with minimum fuss
This doesn't take away responsibility away from the Arch team. I can manually review pkgbuilds all day trying to understand no problem but expecting the user to do it every update is stupid. At some point the user will just start to trust that package maintainer. I already mentioned few steps that the Arch team can take in a comment below.
This doesn’t take away responsibility away from the Arch team.
The Arch team is not responsible for this code.
And to add, demanding to do more work from volunteers which already do a lot of work for free is rude. If you want something done - do it yourself.
I am not talking about the code. I am talking there are basically zero security measures.
Edit:
Demanding to do more work from volunteers which already do a lot of work for free is rude. If you want something done - do it yourself
Then don't make the platforms in the first place. This is such a stupid argument. It's like someone creating a nuke but then ignoring the security measures and telling the rest of the people to take care of it. Genius. Should stop asking people to switch over to Linux as well then. Might as well I should just start bad mouthing and defaming Linux because users are left on their own by a hostile community.
I don’t understand any code so does that mean I shouldn’t use any software? that is 99% of the world.
Not from AUR.
Without the AUR Arch becomes a third world country distro because the official repos have only the basics.
Without the AUR Arch becomes a third world country distro because the official repos have only the basics.
Arch has 17,000 packages and is one of the largest distros. If you want more, you can use Debian, (or maybe NixOS, but you won't get the same quality).
And what do you need so many packages for?
And what do you need so many packages for?
Zen Browser, Elecwhat (Whatsapp -- which is recommended in Arch Wiki), Razer peripherals drivers, heroic games launcher.
"No way to prevent this" says only repository where this regularly happens
I am gonna get a lot of hate for this but the AUR flaws are hidden behind a legal warning of “At your own risk”. They just don’t want to take the legal consequences for this. That’s why there are basically 0 preventive measures for detecting bad actors and preventing malicious attacks.
I can think of some solutions:
yay -Syu one day and getting malware on the system..aurverification file, which can be detected by AUR when putting in the upstream repo URL and the maintainer must verify with that captcha every 6 months or so just to prove active development. If they fail to do so, mark the package as abandoned or unverfied.As an user of the AUR, this is devastating news to me. I am also guilty of accepting updates without reading the latest changes, even if yay asks me if I want to. This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer. And to at least have a look if something suspicious is going in with the recent changes in the package recipe. AND to read in the communities and news.
I don't understand why there still no official announcement as a warning from the Archlinux team at https://archlinux.org/news/ . Is there a different place for security news specifically about the AUR to subscribe to? EDIT: https://archlinux.org/news/active-aur-malicious-packages-incident/ They did it, an official message.
The fact that the Arch maintainers seem to prefer Reddit over their own fucking news channel is what made me switch from Arch years ago. I got sick of upstream breaking changes fucking my system because they wouldn't notify people through official channels, only to find it later on /r/archlinux 🙄🙄🙄
AUR
How do I check if a system has been affected most easily? As far as I have seen it's related to the npm package atomic-lockfile, so would that be enough?
npm ls atomic-lockfile
Whelp...I've REALLY loved EndeavourOS for my laptop, especially because I felt I could mess around with stuff, but maybe this is my call to use something like Fedora or a OpenSUSE variant (I love Tumbleweed dearly).
Nothing against the incredible Arch, but I'm deffos that user who does
> yay
> "Build files exist. Do clean build? N"
> "View changes? N".
ENTER.
I want to learn, but also I'm a bit of a danger to myself if this malware threat is this broad.
Opensuse is great, been daily driving it for 1.5 years with no issues (issues were solved by booting an old snapshot and rolling back, updating again 2d later)
OpenSuSE also comes in two flavours, Leap (a stable release) and Tumbleweed (which is rolling release and sligthly less bleeding edge than Arch).
You can even run Opensuse stable, and in a VM on top Tumbleweed to have a system where you can safely try out new stuff.
There's also Slowroll which is Tumbleweed but like 1 week behind in updates for a stable experience, and there's some immutable flavour that I forgot the name of.
I'm using Tumbleweed, the one issue of rolling release (things occasionally breaking) is not an issue since OpenSuse natively supports snapshots (and automatically makes a snapshot before and after every update).
Something breaks? Reboot -> Boot from read-only snapshot -> selecting the one from before the update -> in terminal: snapper rollback -> done. Update again 2d later.
I’m using Tumbleweed, the one issue of rolling release (things occasionally breaking) [...]
My 5 cents is the risk of breaking is overblown in many cases. Of course, you don't want important servers to break. But I am running Debian since 15 years and in fact, for me it broke more often than Arch, for example because of GNOME issues, or NVidia issues. And well that's a biased sample because I use Debian for a larger proportion of time. I think for desktop users, it matters more to have a backup system.
Yes, the only thing that ever breaks for me are my nvidia drivers (specifically if there arent new drivers for a new kernel yet). Sometimes I don't roll back and just keep it, but often I'm using local AI for uni stuff so I roll back to fix them.
I solved that one by buying an AMD radeon card. Zero fuss since then.
I learned 10 years ago not to use aur helpers because they hide the sources. Aurutils + vifm baby!