6 comments

  • anthonj 35 minutes ago
    I cringed hard when some people started to make pacman wrappers that could install from AUR directly.

    I've installed stuff from the aur before but most of the times I prefer to skip the middleman and just navigate to the project website. A premade pkgbuild is not convenient enough to take the risk of typoquatting or the tactical npm or pip dependency.

    • OJFord 6 minutes ago
      `yay` (one such wrapper) shows me the PKGBUILD diff on every update. The first time I install something I verify the URL, and check any install script etc. seems sensible; the vast majority of subsequent updates are changes to just version number & checksum. A typosquat attack would be very obvious.

      (It's a bit vulnerable to it on first install, but so is 'just navigate to the project website [and click download]'.)

    • pixelpoet 8 minutes ago
      > typoquatting

      Perfect demonstration!

    • Grombobulous 13 minutes ago
      For me, this tradeoff isn’t worth it. I didn’t switch to Linux so that I can waste time going to websites and clicking “download” to update my programs like a Windows user.

      The pacman wrappers you mention are crazy, though.

  • embedding-shape 52 minutes ago
    As always a fair reminder to not install random 3rd party packages/libraries/applications without reviewing them, especially when there is zero vetting. Luckily this was constrained to AUR, which basically is a free-for-all package repository, with users being warned multiple times that it's vital to review anything before you install it, compared to the official repositories.

    `rua` and other similar CLIs make it really easy to review the packages before installing them from AUR too, and if you are doing banking on the same computer, you really have no excuse not to review the software you depend on. Keeping the amount of packages low, only use what you need, also makes this a whole lot simpler when it's time to upgrade.

  • robby_w_g 9 minutes ago
    I’ve made a point of not installing any AUR packages. It’s really tempting when there’s a package that’s not available via pacman, but at the end of the day I’d rather build from source myself or use a docker image.
  • Havoc 21 minutes ago
    As I undertood it this was mostly orphaned packages?
    • Shank 9 minutes ago
      That's correct, orphaned packages could be adopted seemingly automatically, so someone did and then published malware in bulk.
  • tryauuum 50 minutes ago
    How bad was it?
    • graemep 41 minutes ago
      1,500 packages out of 107,000 so pretty bad, ameliorated by only affecting installs of those in a window of a few days.

      AUR comes with a warning that its up to you to check what you install from there.

      • __s 2 minutes ago
        I was concerned at headline, then saw "oh just AUR"

        Next up, "millions of malicious packages still not taken down on internet"

      • maxerickson 7 minutes ago
        I wonder what typical AUR usage looks like. I apparently have 27 packages installed and last updated one in November.
  • new_usemame 21 minutes ago
    [flagged]