The AUR got hit with a malware attack. Again. Normally, one would look at this, lock it down, and figure out what is broken and how one can go about fixing it, but it seems like Arch users want things to stay as they are instead.
And that isn’t an option when the fucking thing is a broken turd of a system.
Generally, if you use the AUR, you’re expected to read the PKGBUILD, which – okay fine. But that is still no excuse for just how insecure the AUR is. Why are there still no guards against flooding the AUR with orphaned packaged adoptions? Why are commit signatures not enforced, which helps prevent impersonation? Yeah, because of the way Git works where you can fill any user/email, and because signatures are not enforced on commits to repositories on the AUR, someone who abandoned a package was impersonated in the latest wave. Simply but, putting all responsibility on the user is not an excuse for crap security, and anyone who says this is an absolute moron. The latest cope from Arch users is claiming that the AUR is a glorified pastebin, which is still not a valid excuse in the slightest. Again, why does this excuse the AUR having such poor security? I’m asking as a former Arch user, someone who did check the PKGBUILD when using the AUR.
What the defenders here don’t realise is that no-one is infallible. Like, sure, you can check a PKGBUILD, but what about the dependencies outside of Arch? Some of these waves hitting the AUR used NPM, Node.js’ package manager. Not everyone is going to be an expert on what looks correct or what is suspicious. Someone could also be having a bad day and not checked something properly. Mistakes are inherent to humanity. No-one is infallible. If these people got hit in these malware waves, I highly doubt they’d be saying the shit they’re saying. There’s this inherent lack of empathy towards people who may have not been aware of the implications of using the AUR.
It’s worth pointing out that two other OSes have an “AUR-like” repository of package scripts: Gentoo, via GURU, and Windows, via Winget. GURU’s rules stipulate that the repo has three layers of contributors, enabling a chain of trust. Winget uses whatever technological and human measures they can to enforce security for package maintainers including the enforcement of commit signatures, and it doesn’t seem like anything too fancy or proprietary to Microsoft. Both of them act on one centralised repository where these attacks won’t scale well rather than a bunch of tiny repositories, and both correctly assume that the user needing some responsibility when handling these packages doesn’t absolve them of any security related faults. Even as I used the AUR, I knew in the back of my mind that this wasn’t a very good way of doing things, and part of the reason I used Cachy during my final times with Linux was because it had some AUR packages on their own repositories, and they were checked. (The lead developer is part of Arch’s package maintainer team, AFAIK)
And here’s the problem. It’s one thing to point out that Microsoft implemented a better system for community-run package maintenance, given that Microsoft has infinitely more money to throw at than Arch even with the Valve sponsorship. The thing is, a less popular distro also implemented a better system, and came to the same conclusion as Microsoft when it came to responsibility, yet people are coming out to defend the AUR and put all the blame on the user rather than the thing that is objectively broken. It exposes one of the problems I have with the Linux community, and why I don’t think Linux will ever be suitable for the desktop (at least, not for me). It’s this complacency from the community. Not even for subpar paradigms like a GUI that isn’t well built – it’s complacency with blatantly broken crap like this. This complacency for crap is also why GIMP has an awful reputation, despite one of their developers telling me that they want to make its UX better, and requesting me to share their efforts on Bluesky (which I have). People will come out to go all “skill issue” on people when GIMP can be pretty damn rough, and I have respect for the developers who are striving for better and wanting to learn how to get there. It’s also why the Fediverse has failed to make any meaningful waves in adoption while Bluesky had more gains in popularity.
It’s the complacency for crap that pisses me off.
And, maybe I shouldn’t care about this, this much. Like, I use Windows now and I’m getting a Mac this month. AUR malware isn’t a problem for me, because I don’t use Arch anymore (unless you count SteamOS? lol). The thing is, I would love to use the Linux desktop as a daily driver. KDE is still the best desktop I’ve used so far and if it weren’t for the fact that MusicBee isn’t on Linux and is pretty clunky on WINE I’d probably have stuck on there. I like a lot of what Linux does, but I don’t delude myself. I know there are things that are inherently broken about it, and the best people in the community are the ones that know that. I want to appreciate what free and open-source software is capable of. If the community doesn’t strive for better, the Linux desktop will stagnate and the only people who will use it are weird nerds and cultists which is not the audience desktop Linux should be striving for.
I would’ve put this on the main post I have about Linux problems, but IDK. Feels right to make a separate post right now. At least I have something I can point to, when the next malware wave hits.
Oh, and as for LLM-based solutions for detecting malicious code? Speaking as someone who doesn’t mind LLMs, I don’t think Arch should resort to that right now. They need to focus on getting the AUR up to scratch security wise without resorting to machine learning, and if they want to use LLMs for that in the future, so be it.