News for hackers. Stuff that matters.

A comment on Android emulator abused to introduce malware onto PCs. Parent comment

Re:Android emulator abused to introduce malware onto PCs by sergeykish on Saturday February 06, 2021 @04:08AM (#26045306)
I trust packages that comes from official repositories.

> Warning: AUR packages are user produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

In other words AUR is not much safer than `curl to | sh`.

[ Parent | on HN ]
Re:Android emulator abused to introduce malware onto PCs by NullPrefix on Saturday February 06, 2021 @08:22AM (#26046323)
I assume AUR includes hashes, which could at least hint to deterministic builds. `curl to | sh` can change from build to build and there's no way to find out from which source other users built.
[ Parent | on HN ]
Re:Android emulator abused to introduce malware onto PCs by gchamonlive on Saturday February 06, 2021 @05:00AM (#26045508)
Sure, but it is centralised in the os distribution package manager, if you use helpers like yay. I am just pointing out that centralisation is not solution to the attack mentioned.
[ Parent | on HN ]