News for hackers. Stuff that matters.

A comment on Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware. Parent comment

Re:Firefox-patch-bin, librewolf-fix-bin AUR packages contain... by bee_rider on Friday July 18, 2025 @04:11PM (#44609257)
On one hand, the distro developers can’t really prevent people from, say, hitting their computers with a sledgehammer or something. So to some extent, the users have to be trusted.

But, maybe it would be best not to have “yay” available. Using something like AUR without reading the package build files is… pretty bad, right? And it is bad for the community, because if there is a convention of doing that sort of thing, it makes the AUR a good target for attacking.

[ Parent | on HN ]
Re:Firefox-patch-bin, librewolf-fix-bin AUR packages contain... by akerl_ on Friday July 18, 2025 @05:56PM (#44610252)
Yay is a 3rd party package manager. The 1st party package manager does not interact with the AUR.

Yay itself is in the AUR. You have to go out of your way to install it.

The Archlinux docs on AUR helpers lead with a red warning: https://wiki.archlinux.org/title/AUR_helpers

[ Parent | on HN ]
Re:Firefox-patch-bin, librewolf-fix-bin AUR packages contain... by bee_rider on Friday July 18, 2025 @08:34PM (#44611413)
Oh, I thought it was a package from the repo. (I didn’t use any of those third party package managers, just stuck to manually doing everything when using the AUR, which was fine because I used it sparingly).
[ Parent | on HN ]
Re:Firefox-patch-bin, librewolf-fix-bin AUR packages contain... by johnisgood on Saturday July 19, 2025 @03:59AM (#44613498)
No, and these AUR helpers are not even official packages in the official repository.
[ Parent | on HN ]
Re:Firefox-patch-bin, librewolf-fix-bin AUR packages contain... by thedanbob on Friday July 18, 2025 @06:57PM (#44610708)
> But, maybe it would be best not to have “yay” available. Using something like AUR without reading the package build files is… pretty bad, right? And it is bad for the community, because if there is a convention of doing that sort of thing, it makes the AUR a good target for attacking.

I don't remember how yay works but paru (another AUR package manager) displays the pkgbuild file before it will install.

[ Parent | on HN ]