Ahh clearly Arch users didn’t RTFM before installing shit. Skill issue.
PS: The above is an invitation to self-care, not an insult.
I must say, Read The Fucking Manual is a bit more clear than Read The Friendly Manual.
I disagree with the post you put here on a single thing: the manual is sometimes bad, by either not describing everything, or being unclear.
Is that worse than not reading it at all? Often it is a lead to something more useful
You know what? You’re right
Best not to read any then, if it might be bad.
I’ve seriously gone through manuals in languages foreign to me and still learnt something from it.
My partner doesn’t and will only use the basic features of tech. I read the manual, and I’m suddenly a wizard because I got two Bluetooth speakers to pair with each other and get stereo from them.
Reading the manual clearly won’t help with the issue here. This is clearly not an appropriate use of RTFM terminology here, because it does not apply. The problem here is not that the user needs to read before asking for help. The problem here is to understand the changes made in the script are malicious. And reading the manual won’t help with that.
How do I check if a system has been affected most easily? As far as I have seen it’s related to the npm package atomic-lockfile, so would that be enough?
npm ls atomic-lockfileThe AUR is basically just a shortcut for downloading random shit off GitHub.
It gives un-experienced users a false sense of security.
AUR
Play stupid games win stupid prizes I guess.
Wow that’s bad 🫢
There were announcements and security ping in the arch Linux discord… But I wish they’d be more vocal on this outside discord especially given discords controversy as of late
There’s a official Arch Linux D*scord?
No it’s unofficial but it’s I believe the biggest/primary arch Linux community discord .
In their roles chanel you can pick one to get security pings… major ones are typically also everyone pinged but some have those disabled
You’ll pry #archlinux from my cold dead hands
Least surprising thing ever. Nothing is reviewed or approved, not even proforma
As an user of the AUR, this is devastating news to me. I am also guilty of accepting updates without reading the latest changes, even if
yayasks me if I want to. This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer. And to at least have a look if something suspicious is going in with the recent changes in the package recipe. AND to read in the communities and news.I don’t understand why there still no official announcement as a warning from the Archlinux team at https://archlinux.org/news/ . Is there a different place for security news specifically about the AUR to subscribe to?
This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer.
Unfortunately not foolproof either. I have no infected packages that I know of because I happen to be on a new install, but I caught wind of the LAST AUR botnet infiltration and switched to flatpaks or source builds. Since then I drifted back to AUR for convenience. I thought I was being clever only using AUR packages when I could be “sure” the author of the original software package pushed to AUR, and this was easy since devs who build on Arch typically recommend AUR whether they maintain the package or not. Today I found out spoofing package ownership is apparently easy and so is spoofing git credentials.
I was on Endeavour and it was incredible, but I’m not That Power User and I feel like part of the problem. The worst part of all of this is its owing to an influx of users who want the same ease of use they used to enjoy, but in Windows SOP is installing whatever the fuck you want on Internet Explorer and bugging your sysadmin to fix whatever happens. Its probably really hard to be any kind of FOSS developer right now.
Yes, definitely not foolproof. This is more of a wake up call to be at least careful and reconsider every single AUR package one has installed. For me, I was lucky too. But in my case it wasn’t pure luck that the few AUR packages I have installed aren’t affected. See, because since years using the AUR (sparingly! including my own package :D ) I always feared off orphaned packages and removed them as soon as I could. This incident here is proof I was right.
For some stuff I also prefer the Flatpak, because I do not trust everyone on the AUR, as they operate on root rights! When I brought this up on Endeavor, they disliked my opinion (as a fresh user) and the trusted community members there explained to me that the AUR is way more safe than Flatpak, because there is a trust system of upvotes and everyone can flag the packages, and that Flatpak has a wrong sense of security. That is what they told me and totally ignored my issues with AUR… one of the reasons why I do not visit the EndeavourOS community… I digress…
The fact that the Arch maintainers seem to prefer Reddit over their own fucking news channel is what made me switch from Arch years ago. I got sick of upstream breaking changes fucking my system because they wouldn’t notify people through official channels, only to find it later of /r/archlinux 🙄🙄🙄
What are you using now?
After the end of Win10 I moved to arch but I think my week end will be filled with moving again. ^^
On my desktop, CachyOS 💀
It was years ago when Arch pissed me off, but I couldn’t resist Arch-based distros forever. So far, I haven’t been burned.
On my laptop, Asahi Linux, which is basically Fedora ARM with a custom kernel. I’d recommend Fedora to most general users.
They made an announcement though
Dnnxnhxxx
since the 2022 grub incident, Arch has done a great job at notifying the news channel when “manual intervention required” AFAIK, and I don’t remember any instances of Arch maintainers only notifying Reddit (and I don’t think they notified Reddit for the grub incident either lol).
It’s been 4 years already? WTF?
the arch news channel is for breaking changes to arch pacakges (so not the AUR) only. maybe you could subscribe to aur-general@lists.archlinux.org.
I was hoping to subscribe with RSS. Not sure how to subscribe there.
it’s a mailing list, so heads up, if you subscribe you’re also gonna get other discussion like the forums.
https://lists.archlinux.org/mailman3/lists/aur-general.lists.archlinux.org/
They are actually putting a message on the regular news feed about the AUR! https://archlinux.org/news/active-aur-malicious-packages-incident/ As it should be. It just took a bit too long in my opinion, as discussions are going on since yesterday.
EDIT: https://archlinux.org/news/active-aur-malicious-packages-incident/ They did it, an official message.
I wish they’d actually explain their findings/attack vectors so that people have a chance to stay ahead of this by reading the PKGBUILDs as recommended.
At this point, the count stands at 1500+ https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
AUR
Whelp…I’ve REALLY loved EndeavourOS for my laptop, especially because I felt I could mess around with stuff, but maybe this is my call to use something like Fedora or a OpenSUSE variant (I love Tumbleweed dearly).
Nothing against the incredible Arch, but I’m deffos that user who does
> yay > "Build files exist. Do clean build? N" > "View changes? N".ENTER.
I want to learn, but also I’m a bit of a danger to myself if this malware threat is this broad.
Have you heard about the recent fuckups of fedora? fedora is a shitshow.
If you just yolo with yay anyway, you will get compromised on any system you use, ni matter the OS or distro, my dude.
Could you elaborate wrt Fedora being a shitshow? It’s my daily driver and I haven’t experienced any kind of instability and (to my knowledge) I have not been compromised.
Have you heard about the recent fuckups of fedora? fedora is a shitshow.
Oh really? I guess I haven’t. 😬
Yeah it was late here so I think I was poorly mushing two separate thoughts together there. I meant I was thinking of moving to a distro that isn’t as bleeding-edge for the laptop I’m not updating every single day…But also I should find something that still has a nice large software variety so I stay off AUR.
OpenSUSE has the “Open Build System” which I’ve used for like one package. So that’s pretty neat.
This is really tough because I have two gamers in the family using Nvidia cards I want to help move off of Windows, but I don’t want them running into having to roll back as often as I have or fiddle too much, but I feel like Mint is a little too far behind.
So I was considering the KDE spin of Fedora for them…But yeah, the answer isn’t so easy anymore lol.
Opensuse is great, been daily driving it for 1.5 years with no issues (issues were solved by booting an old snapshot and rolling back, updating again 2d later)
OpenSuSE also comes in two flavours, Leap (a stable release) and Tumbleweed (which is rolling release and sligthly less bleeding edge than Arch).
You can even run Opensuse stable, and in a VM on top Tumbleweed to have a system where you can safely try out new stuff.
There’s also Slowroll which is Tumbleweed but like 1 week behind in updates for a stable experience, and there’s some immutable flavour that I forgot the name of.
I’m using Tumbleweed, the one issue of rolling release (things occasionally breaking) is not an issue since OpenSuse natively supports snapshots (and automatically makes a snapshot before and after every update).
Something breaks? Reboot -> Boot from read-only snapshot -> selecting the one from before the update -> in terminal: snapper rollback -> done. Update again 2d later.
I’m using Tumbleweed, the one issue of rolling release (things occasionally breaking) […]
My 5 cents is the risk of breaking is overblown in many cases. Of course, you don’t want important servers to break. But I am running Debian since 15 years and in fact, for me it broke more often than Arch, for example because of GNOME issues, or NVidia issues. And well that’s a biased sample because I use Debian for a larger proportion of time. I think for desktop users, it matters more to have a backup system.
Yes, the only thing that ever breaks for me are my nvidia drivers (specifically if there arent new drivers for a new kernel yet). Sometimes I don’t roll back and just keep it, but often I’m using local AI for uni stuff so I roll back to fix them.
I solved that one by buying an AMD radeon card. Zero fuss since then.
the AUR ideally should have a dedicated team of moderators of packages round the clock but archlinux is a community distro, and you really shouldn’t trust the AUR implicitly and treat it as literally downloading stuff from the internet through search because that’s what it does most of the time.
I do use AUR though, and only one (obs-studio-liberty) is not endorsed by the programs I use from it
Do you even read the pkgbuild files you DL from the AUR?
Also keep in mind that Arch is (differently from FOSS diehard people like Debian maintainers) quite permissive in what it accepts. This might be comfortable to get some hardware running, but with this you get also stuff like Brave Browser in the software directory which, how do I say this, might not be the best choice for privacy.
So,if you want privacy and safety, you should have a good look at what you install.
AUR is not Arch maintainer vetted repo tho. Even librewolf is not in the arch repo.
The closest equivalent of AUR is PPA/launchpad
(hopefully this doesn’t read as blaming the victims instead of the attackers but) I personally don’t think it’s that complicated to read the updates to AUR packages. It’s not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?
i wouldnt know where to get the info in the first place. when i use windows update i also dont reed any changelog because that shouldnt be the users job but the suppliers
As an avid user of the AUR, you’d be correct if you were downloading from the official arch repository. But you aren’t. AUR is basically like downloading from github. The only “guarantee” you get is from whoever put the package up and its up to you to determine if they’re trustworthy.
The whole point of the AUR is that it’s just random people’s code. There is no supplier here. If you don’t know where to find that information, you really shouldn’t be using AUR.
In an ideal world yes, but I needed some software that was only available via AUR and if the official guides tell me I can install it via AUR I will.
I don’t think it’s immediately obvious that the PKGBUILD installing some shit with npm is malware.
it’s bypassing the normal place to download (in the PKGBUILD) and doing so in a place that’s unsandboxed instead (in the .install file, not the PKGBUILD) when it didn’t need to do that before
GOTDAMN
