Arch Linux disables AUR package adoption (https://news.ycombinator.com/item?id=49123208)
I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over.
LLMs make large scale and long-term attacks easy and cheap. You could (and if I was a three letter agency, I would probably do so!) maintain ten thousand packages as three thousand separate "individuals" for years before cashing in the trust you've built up.
I'm almost scared to ask, did you not even review the PKGBUILD or anything else before installing stuff from the AUR?
Nixpkgs has a completed different model compared to AUR, the changes that end up in nixpkgs are all reviewed by maintainers, while AUR is literally free-for-all "anyone can push anything at any time", I don't think you ever could "naively and gratefully trust" AUR in the way you might have been.
I'd venture most people actually don't review pkgbuild; especially on upgrades.
The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned.
You can even hide nefarious code in the compilation/build steps, Jia Tan style.
No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?
> The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned.
Sure, that's why when you review the PKGBUILD, and instead of it using the official GitHub organization / domain (which you of course validate) for downloading the binary/source, you don't install it.
I agree it's still vulnerable to Jia Tan style attacks, but installing from AUR is essentially "curl http://random-website.com/script.sh | bash", and reviewing a PKGBUILD takes a few seconds, and stop/cancel if something is sus, it's really that easy.
I would assume essentially everyone? `curl https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from the internet into bash.
> reviewing a PKGBUILD takes a few seconds
This assumes a naive attack that is easily visible from the PKGBUILD. Unless the attacker makes no effort to hide their activity, the PKGBUILD will look perfectly ordinary while still installing malware.
mijoharas•39m ago