The question here is why the f’ didn’t they shut down AUR packages takeover procedure? It makes no sense facing an attack of such a large scale.
It’s the USER repositories. If you go, right now, to aur.archlinux.org, the very first section on the page after the header says
That’s always been there and every official messaging I’ve ever seen about the AUR has conformed. Read the changelogs because everything in the AUR is just a shell script some stranger wrote.
Why should they? AUR is still working as intended. It’s basically a public wiki of shell scripts, it was never intended to be secure in the first place. It has always been the user’s responsibility to review everything or avoid using it.
Honestly I take no issue with the malware attack. I find it more offensive that many publications write it like it’s the end of Arch. Like bro, AUR is NOT what I’d recommend to beginners to get their packages from. Some of the obscure packages include browser extension. Like, why would you install an extension from the AUR instead of the browser extension marketplace? This is why easy and braindead AUR helpers need to die. It encourages bad practice
people can install malware from untrusted source
how is this news even worthy?
I am thankful I have been away from my arch machine this past week and so never got the chance to install infected updates from the AUR, because I for sure have gotten complacent with checking entire PACKAGEBUILDs. The checker scripts the community has put together found a single potential infected package on my machine -
alvr-git- but I had last installed/updated that one on may 21 (so in theory it’s clean).When the script is three pages long on a 4k screen, and I have ten other packages to review, I have found it’s really hard to stay committed to checking it all with my own eyes. The threat of needing to nuke my entire machine and rotates all my creds will certainly help with that, sadly.
“AUR is such a great feature but why the fuck would anyone use it?” seem to be the general reaction for Arch community. (I use Debian BTW).
More like warnings are plastered all over to not use easy helper and to always check, verify, and trust package carefully. But ohh, that sign can’t stop me because I can’t read apparently
My point exactly.
