Arch Linux

9793 readers

2 users here now

The beloved lightweight distro

founded 6 years ago

MODERATORS

k_o_t@lemmy.ml

Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages (www.phoronix.com)

submitted 6 days ago by steam_lover@sh.itjust.works to c/archlinux@lemmy.ml

25 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] erev@lemmy.world 9 points 6 days ago (4 children)

Or make it so that the AUR has a modicum of security and not allow brand new accounts to adopt orphaned packages and immediately push out malware without any form or reviews, checks, or interventions.

[–] excel@lemming.megumin.org 3 points 5 days ago

It’s basically a public wiki of scripts, being editable by anyone is the entire point. If you don’t want to run random scripts from random people, don’t use AUR.

[–] bitfucker@programming.dev 3 points 6 days ago

If I copy paste a malicious script here and you run it without knowing/checking what it do, do you think your instance admin should also put more rules and restrictions for the whole instance? AUR is no different than github or pastebin. It is on the user to vet what script they are running. Arch already has a more strict and vetted repo by the maintainer. Having AUR be a vetted place has no real good solution because of easy botting.

[–] SenatorCollins@aussie.zone 3 points 6 days ago (1 children)

Oh, very rigorous software engineering standards.

[–] A_norny_mousse@piefed.zip 2 points 6 days ago* (last edited 5 days ago) (1 children)

That's not what the AUR does. They simply provide a platform for users to share build scripts. There isn't much they can do beyond trying to vet accounts based on flimsy metrics, or weeding things out every now and then.

The problem is that some people and even distros treat the AUR as a trusted source of software.

All user repositories (javascript, Python etc.) suffer from malware btw.; the AUR is different in that it explicitely puts the responsibility of building packages on the user.

...

~~I'm still missing some palpable information about these injections/malwares.~~
https://bbs.archlinux.org/viewtopic.php?id=313892

[–] SenatorCollins@aussie.zone 1 points 6 days ago

Absolutely ludicrous. These are very very strong packages.

[–] A_norny_mousse@piefed.zip 1 points 6 days ago* (last edited 6 days ago) (1 children)

not allow brand new accounts to adopt orphaned packages

Is that not the case already? If not I'm sure it'll be one of the fixes.

[–] SenatorCollins@aussie.zone 2 points 6 days ago

Well, there are regulations governing the code they can be made of.