News for hackers. Stuff that matters.

A comment on Arch Linux AUR Repository Found to Contain Malware. Parent comment

Re:Arch Linux AUR Repository Found to Contain Malware by craftyguy on Tuesday July 10, 2018 @04:44PM (#17501979)
> while all AUR helpers I've seen explicitly ask you if you'd like to first review the files in an editor

The good ones do, yes.

> with a default answer of [Y]es.

And therein lies the problem. You may review a handful up front, but then convince yourself that all is good since it's much easier to just press 'enter' and move on. It's MUCH easier to ignore a PKGBUILD when you have to hit one key to skip it than it is if you have to manually download it, put it somewhere, and 'makepkg' on it.

[ Parent | on HN ]
Re:Arch Linux AUR Repository Found to Contain Malware by jolmg on Tuesday July 10, 2018 @05:07PM (#17502171)
I think you misread. Pressing 'enter' opens up the editor to review the files. To ignore them, you'd have to answer [n]o.
[ Parent | on HN ]
Re:Arch Linux AUR Repository Found to Contain Malware by craftyguy on Tuesday July 10, 2018 @05:17PM (#17502265)
Ah, in that case, most I've come across do not default to 'edit', but rather to accept. Notice that many default to automatic building: https://wiki.archlinux.org/index.php/AUR_helpers#Active
[ Parent | on HN ]
Re:Arch Linux AUR Repository Found to Contain Malware by jolmg on Tuesday July 10, 2018 @05:53PM (#17502538)
Huh. Thanks for the link; I hadn't realized that pacaur was announced unmaintained last December. I'll have to look for a replacement.
[ Parent | on HN ]
Re:Arch Linux AUR Repository Found to Contain Malware by bscphil on Tuesday July 10, 2018 @08:36PM (#17503474)
The developer of pacaur now works on auracle.
[ Parent | on HN ]
Re:Arch Linux AUR Repository Found to Contain Malware by Foxboron on Tuesday July 10, 2018 @08:44PM (#17503518)
Falconindy is not the developer of pacaur.
[ Parent | on HN ]
Re:Arch Linux AUR Repository Found to Contain Malware by bscphil on Tuesday July 10, 2018 @09:17PM (#17503688)
That's right, I was thinking of Cower. My mistake.
[ Parent | on HN ]
Re:Arch Linux AUR Repository Found to Contain Malware by jolmg on Tuesday July 10, 2018 @09:43PM (#17503803)
Oh man, I'm feeling uninformed. So cower is being deprecated and Falconindy is rewriting it as auracle. I guess that's 2 programs I'll have to replace. At least I know this one's replacement.
[ Parent | on HN ]
Re:Arch Linux AUR Repository Found to Contain Malware by imtringued on Tuesday July 10, 2018 @07:10PM (#17502992)
aurman is the best replacement
[ Parent | on HN ]