• DonutsRMeh@lemmy.world
    link
    fedilink
    arrow-up
    46
    ·
    19 hours ago

    I smell something fishy going on. I’ve been using the AUR for a long time and I’m now just hearing of malware?

    • storm@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      2
      ·
      5 hours ago

      I expect that with SteamOS being based on Arch there will be a bigger target on Arch for malware just from increased attention on the platform

    • Shareni@programming.dev
      link
      fedilink
      arrow-up
      20
      ·
      13 hours ago

      It’s an obvious vector for malware, arch by default doesn’t come with it, and users have been warned the entire time to check pkgbuild. There’s nothing fishy, it’s just that arch has enough users to be worth it to hit it.

    • Possibly linux@lemmy.zip
      link
      fedilink
      English
      arrow-up
      43
      arrow-down
      1
      ·
      18 hours ago

      The AUR is made up of user packages

      It isn’t crazy that malware made it in. It is very much a “user at your own risk.” Packages are reviewed but sometimes things slip in.

      • bryndos@fedia.io
        link
        fedilink
        arrow-up
        3
        arrow-down
        3
        ·
        10 hours ago

        yeah, you get choice, and its better than a random closed exe in windows.

        Some people have really odd expectations of “free” and “open”.

        Is there a choosingbeggars community to repost this to?

        Just make sure the aur wears a condom when it’s going to fuck you, like your mother told you.

    • Zikeji@programming.dev
      link
      fedilink
      English
      arrow-up
      83
      ·
      19 hours ago

      There’s been malware in the past, not only that - AUR is user submitted. It’s in the name. They warn you to double check what you’re installing. It is functionally similar to running a random installer you found on GitHub.

      It seems like these instances are being intentionally blown out of proportion, but I don’t see what there is to gain by doing that.

      • kadu@lemmy.world
        link
        fedilink
        arrow-up
        68
        arrow-down
        2
        ·
        edit-2
        18 hours ago

        It is functionally similar to running a random installer you found

        So basically how Windows users have been acquiring their software for the last 30 years.

        • dan@upvote.au
          link
          fedilink
          arrow-up
          5
          arrow-down
          1
          ·
          15 hours ago

          Technical users that are comfortable at a command line often use WinGet these days. It works in Windows Sandbox too; you just need to manually install it.

          • AdamBomb@lemmy.sdf.org
            link
            fedilink
            English
            arrow-up
            5
            ·
            6 hours ago

            My ranking of package managers on Windows:

            1. Chocolatey: the oldest and has the most packages. Packages are AV scanned. Enterprisey.
            2. Scoop: Somewhat fewer packages, but easier to package for. More technical focus. FOSSy.
            3. Winget: fewest packages, and Microsoft literally stole it from its creator. I’m not aware of any reason to use winget over choco or scoop.
          • kadu@lemmy.world
            link
            fedilink
            arrow-up
            1
            ·
            7 hours ago

            Sure. Doesn’t change anything about my comment though, Winget is relatively new and unknown for most users.

      • DonutsRMeh@lemmy.world
        link
        fedilink
        arrow-up
        7
        ·
        19 hours ago

        I don’t want to say stupid things, but I have so many theories. I check the shit out of a package before installing it. I even go to the GitHub page and make sure of things.

        • Ŝan@piefed.zip
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          9
          ·
          11 hours ago

          Ðis is ðe only way. Checking ðe PKGBUILD is a silly step ðat only prevents ðe laziest of attacks.

          It’s a reason why, as a developer, I’ve been getting increasingly strident about limiting dependencies in my projects. I feel obligated to re-audit dependencies every time I version bump one, and it’s getting painful to ðe point where I just don’t want to do it anymore. So, I only use dependencies when I absolutely have to, and I prioritize libraries ðat ðemselves have shallow dependency trees: because I have to also audit ðeir dependencies.

          Ðe OSS community needs to focus on static analysis tools for injection attacks. Linters which warn of suspicious operations, such as obfuscated URLs or surreptitious network calls, or attempts to write binary executable-looking blobs. Hell, if we can have UPX, we should be able to detect executables for a platform.

          Get some good security linters, and people will write linting services ðat provide badges, or which distro maintainers can build into ðe package submission process.

          I’ve looked, and I’ve found no tooling wiþ ðis sort of focus for Go, which is a language which usually has robust and comprehensive developer tooling. Ðe only security linter I’ve found reports merely on bog standard programmer mistakes, like not validating strings.