Arch Linux disables AUR package adoption

ddatabase64128 about 4 hours ago 24 commentsRead Article on lwn.net

FR version is available. Content is displayed in original English for accuracy.

⚡ Community Insights

Discussion Sentiment

69% Positive

Analyzed from 691 words in the discussion.

Discussion (24 Comments)Read Original on HackerNews

WD-42•41 minutes ago

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks.

It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

sp0rk•30 minutes ago

> I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

This has absolutely not ever been the case.

jolmg•22 minutes ago

Arch is simply getting popular enough to be targeted.

charcircuit•39 minutes ago

Desktop Linux has always been a house of cards in regards to security. I agree it's amazing that it went on for so long, but this was inevitable.

mindlessg•6 minutes ago

Castles made of sand slips into the sea, eventually

zahlman•15 minutes ago

More so than, say, Windows? Really?

And no, "people using one Linux distro can opt in to possibly getting pwned by each other by making use of a third-party software depot" does not reflect upon the entirety of the Linux world.

nvme0n1p1•8 minutes ago

It's funny how these people say Linux security is bad because random people can upload arbitrary files to AUR, but won't say Windows security is bad because random people can upload arbitrary files to Microsoft GitHub.

tempfile•18 minutes ago

I disagree. Maintainers for the major distributions take their roles very seriously, and do a very good job generally of filtering out malicious packages. The AUR is an outlier, being essentially an unmaintained wild west.

dandersch•32 minutes ago

I think Arch has to rethink what the AUR really is for in the age of AI.

If users aren't supposed to trust anything from the AUR, then they will start to use LLMs to scan PKGBUILDs for them. But at that point, why not let the LLM loose directly on the upstream repo and build+install the package from source?

nvme0n1p1•13 minutes ago

You really don't see the difference between a deterministic script installing a tarball pinned by its hash, and "sudo chatgpt install master branch of this repo"?

zache6•14 minutes ago

I haven't been updating AUR packages since the initial incident. Thankfully hadn't updated for a week prior to it. Tonight I'll be uninstalling all the AUR packages I possibly can.

uticus•20 minutes ago

WRT package vulns, I'm surprised there's not more technical theory out there. We have plenty of theory around algorithm design, but so far I haven't heard much about inspecting and improving control of dependencies in source - apart from conflict and version management.

Seems like instead of big-O notation, we could have a "reach index" - how far does the top-level code need to reach, to be effective? Top-level -> Userland lib 1 -> Userland lib 2 -> Kernel, would be a reach level "4" - not the simplest, but much simpler to inspect and securely build than reach level "20".

delecti•about 1 hour ago

That title had me worried, but the reality seems quite reasonable.

I assumed the goal was to reduce usage of AUR, they've actually remove the ability to adopt (take ownership of) orphaned packages. I'm sure there are legitimate uses of that functionality, but it also seems like a pretty big avenue for abuse.

bee_rider•4 minutes ago

IMO allowing package adoption makes sense in the responsible/intended use-case: AUR packages aren’t trusted, you have to read the PKGBUILD anyway, so the reputation of the contributor doesn’t matter. Removing adoption is admitting that there’s no way to prevent some users from blindly trusting a PKGBUILD.

Which is probably the best choice, unfortunately.

jolmg•14 minutes ago

> I'm sure there are legitimate uses of that functionality

To avoid package name pollution, e.g. having package foo, foo-newpackage, foo-newpackage-updated, etc. each by a new maintainer as the priors get abandoned.

OJFord•about 1 hour ago

I've used it (not for abuse). It's simply volunteering to maintain the package after previous maintainer(s) have explicitly disowned it, knowing they no longer have time for it or don't care because they stopped using it, etc.

gchamonlive•about 1 hour ago

Problem is that there is no KYC process before someone can adopt any orphaned package

ameliaquining•about 1 hour ago

Yeah, the security problems with unilateral adoption of orphaned packages by unprivileged users are fundamental and unfixable; the only remedy is to remove the feature. Whether it has legitimate use cases (which it sounds like it does) is irrelevant. I'm not sure why it took them so long to realize this and act accordingly, but I'm glad they now have.

tim-projects•26 minutes ago

I added a git repo to AUR last year. It was super easy with basically no checks of any kind. Once these reports came out recently, I went through and deleted every AUR package that I could.

uticus•24 minutes ago

From the actual announcement:

> ...package adoption is currently disabled while we are handling the situation.

Sounds much more like the temporary pause, than the much less temporary-sounding "has been disabled" from the OP.

Sleaker•about 1 hour ago

I don't think any form of automated adoption of orphaned packages will ever work, it's just too easy to introduce malicious code into an otherwise functional but no longer maintained source.

charcircuit•41 minutes ago

AUR should be scanning new uploads for malware before allowing them to be published.

tempfile•16 minutes ago

What does "scanning for malware" mean? As far as I know this is a totally open question, and the only credible answers (install in a sandbox) are too inconvenient for widespread adoption.