Arch Linux AUR Repository Found to Contain Malware

Re:Arch Linux AUR Repository Found to Contain Malware by westmeal on Tuesday July 10, 2018 @04:36PM (#17501913)

Doesnt everyone know AUR packages are inherently unsafe? if you wanted to make sure they werent up to something you could read the pkgbuild

[ Parent | on HN ]

Re:Arch Linux AUR Repository Found to Contain Malware by Skunkleton on Tuesday July 10, 2018 @05:53PM (#17502542)

Given the design of most of the AUR "helpers" out there, I would guess that there are a non-trivial amount of users who view the AUR as safe.

[ Parent | on HN ]

Re:Arch Linux AUR Repository Found to Contain Malware by dbrgn on Tuesday July 10, 2018 @06:35PM (#17502803)

Yaourt shows a big fat red warning every time you install a package. It also offers to open PKGBUILD and .install files for inspection.

[ Parent | on HN ]

Re:Arch Linux AUR Repository Found to Contain Malware by d4l3k on Tuesday July 10, 2018 @09:55PM (#17503849)

Yaourt is also unmaintained and unsafe. Please switch to something better.

https://wiki.archlinux.org/index.php/AUR_helpers#Active

[ Parent | on HN ]

Re:Arch Linux AUR Repository Found to Contain Malware by dbrgn on Wednesday July 11, 2018 @03:44AM (#17505126)

Oh wow. I was not aware, thanks for letting me know!

[ Parent | on HN ]

Re:Arch Linux AUR Repository Found to Contain Malware by imtringued on Tuesday July 10, 2018 @07:06PM (#17502974)

It should just show the PKGBUILD every time. If it's not doing anything sketchy it's often only a dozen lines.

[ Parent | on HN ]

Re:Arch Linux AUR Repository Found to Contain Malware by Skunkleton on Tuesday July 10, 2018 @07:39PM (#17503168)

aurman does a good job. It caches the old PKGBUILD and lets you view diffs. Still, reviewing a PKGBUILD is a non-trivial process.

[ Parent | on HN ]

Re:Arch Linux AUR Repository Found to Contain Malware by ronjouch on Tuesday July 10, 2018 @07:54PM (#17503273)

Thanks! I got bored of looking for a yaourt replacement because they seemed all the same, and discussions of AUR helpers often turn into flamewars, but PKGBUILD diffs is a valuable feature. Trying aurman :)

[ Parent | on HN ]

Re:Arch Linux AUR Repository Found to Contain Malware by ilikehurdles on Wednesday July 11, 2018 @11:47AM (#17507817)

Honestly, no, not everyone knows this. Maybe when there was just arch linux and no spinoffs; but manjaro provides an easy path to a rolling-release arch(-like) distribution, and it treats AUR as a first-class citizen in its GUIs. I think there was a popup at some point when an application first accesses AUR that tells you that AUR is unsupported and to go to a wiki to understand it, but I think it could use better messaging. A warning at the header of the AUR section of the package manager gui would be a good start.

[ Parent | on HN ]