5 ms·

Well, I guess I'll avoid updating for the next few days. A bit worrisome that I did so last night. I wish I had a clear operating system to switch to for safet

by numeri 2mo ago

Well, I guess I'll avoid updating for the next few days. A bit worrisome that I did so last night. I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over. LLMs make large scale and long-term attacks easy and cheap. You could (and if I was a three letter agency, I would probably do so!) maintain ten thousand packages as three thousand separate "individuals" for years before cashing in the trust you've built up.

embedding-shape 2mo ago
> naively and gratefully trust in the armies of volunteer maintainers is over I'm almost scared to ask, did you not even review the PKGBUILD or anything else before installing stuff from the AUR? Nixpkgs has a completed different model compared to AUR, the changes that end up in nixpkgs are all reviewed by maintainers, while AUR is literally free-for-all "anyone can push anything at any time", I don't think you ever could "naively and gratefully trust" AUR in the way you might have been.
- ireadmevs 2mo ago
  > the changes that end up in nixpkgs are all reviewed by maintainers They review the “recipes”, sure. But I don’t know if I’d trust that every diff of the source of every package update is reviewed by them.
- dijit 2mo ago
  > did you not even review the PKGBUILD or anything else before installing stuff from the AUR? I'd venture most people actually don't review pkgbuild; especially on upgrades. The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. You can even hide nefarious code in the compilation/build steps, Jia Tan style.
  - embedding-shape 2mo ago
    > I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. Sure, that's why when you review the PKGBUILD, and instead of it using the official GitHub organization / domain (which you of course validate) for downloading the binary/source, you don't install it. I agree it's still vulnerable to Jia Tan style attacks, but installing from AUR is essentially "curl http://random-website.com/script.sh http://random-website.com/script.sh | bash", and reviewing a PKGBUILD takes a few seconds, and stop/cancel if something is sus, it's really that easy.
    - fantyoon 2mo ago
      > No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? I would assume essentially everyone? `curl https://random-website.com/script.sh https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from the internet into bash. > reviewing a PKGBUILD takes a few seconds This assumes a naive attack that is easily visible from the PKGBUILD. Unless the attacker makes no effort to hide their activity, the PKGBUILD will look perfectly ordinary while still installing malware.
      - embedding-shape 2mo ago
        What PKGBUILD referencing official sources that been attacked would not be easily visible? The second the source changes away from official sources, you stop installing from it. It's one line you have to review, usually pointing to either a Github release or a CDN/download host under the official domain.
        2mo ago
- numeri 2mo ago
  I review the PKGBUILD often, but not always. The majority of the time when I do, it amounts to seeing a URL change. If I actually do check the URL it points to, it's just to verify it's official/the actual repo or source I intended to trust. I was honestly never very worried about the attack vectors that are visible in PKGBUILD. Historically, with the rather popular AUR packages I install, any attack would be noticed rather quickly, which limits would-be attackers to those who don't care who they hack and don't mind it being short-lived. The threats I was more worried about were those from more malicious/advanced sources that would attack more subtly upstream – but if I've already decided to download and run a precompiled binary from a repo, I've already decided to accept that risk. In other words, in the past, I relied mainly on the goodness and vigilance of the community, only occasionally investing time to check myself on less mainstream packages or repos. Was this ideal? No. Was it sufficiently responsible? As it was my own machine and my own data at risk, I believe so. And to be honest, I've not had a single problem in over a decade of doing so. That's clearly got to change now, though.
skydhash 2mo ago
I used alpine linux and it looks pretty easy to setup your own repository, including build scripts for packages. I now use OpenBSD and the port systems of the BSD (each are different BTW) make it also easy to add extra software.
matheusmoreira 2mo ago
> the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over The maintainers you're supposed to trust are Arch Linux's actual staff made up of package maintainers, formerly known as trusted users. AUR packages are maintained by randoms on the internet. Anyone can sign up and push a package.
matheusmoreira 2mo ago
> I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Can't have it both ways. Your packages can come from a small number of trusted individuals who maintain the software distribution. Naturally, this limits your choices to the packages they personally maintain. If you need something outside of that set, you need to ask them to include it or source it yourself. Alternatively, your packages can come from a software repository that allows internet randoms to push literally anything. That expands your selection to all software ever created, which includes malware since nobody's doing the work to filter that stuff out. Arch Linux offers both paradigms. Make an informed decision.
- numeri 2mo ago
  I agree one hundred percent! Doesn't mean I can't wish I could have it both ways :)

by numeri 2mo ago

embedding-shape 2mo ago

> naively and gratefully trust in the armies of volunteer maintainers is over I'm almost scared to ask, did you not even review the PKGBUILD or anything else before installing stuff from the AUR? Nixpkgs has a completed different model compared to AUR, the changes that end up in nixpkgs are all reviewed by maintainers, while AUR is literally free-for-all "anyone can push anything at any time", I don't think you ever could "naively and gratefully trust" AUR in the way you might have been.

ireadmevs 2mo ago
> the changes that end up in nixpkgs are all reviewed by maintainers They review the “recipes”, sure. But I don’t know if I’d trust that every diff of the source of every package update is reviewed by them.
dijit 2mo ago
> did you not even review the PKGBUILD or anything else before installing stuff from the AUR? I'd venture most people actually don't review pkgbuild; especially on upgrades. The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. You can even hide nefarious code in the compilation/build steps, Jia Tan style.
- embedding-shape 2mo ago
  > I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. Sure, that's why when you review the PKGBUILD, and instead of it using the official GitHub organization / domain (which you of course validate) for downloading the binary/source, you don't install it. I agree it's still vulnerable to Jia Tan style attacks, but installing from AUR is essentially "curl http://random-website.com/script.sh http://random-website.com/script.sh | bash", and reviewing a PKGBUILD takes a few seconds, and stop/cancel if something is sus, it's really that easy.
  - fantyoon 2mo ago
    > No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? I would assume essentially everyone? `curl https://random-website.com/script.sh https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from the internet into bash. > reviewing a PKGBUILD takes a few seconds This assumes a naive attack that is easily visible from the PKGBUILD. Unless the attacker makes no effort to hide their activity, the PKGBUILD will look perfectly ordinary while still installing malware.
    - embedding-shape 2mo ago
      What PKGBUILD referencing official sources that been attacked would not be easily visible? The second the source changes away from official sources, you stop installing from it. It's one line you have to review, usually pointing to either a Github release or a CDN/download host under the official domain.
      - 2mo ago
numeri 2mo ago
I review the PKGBUILD often, but not always. The majority of the time when I do, it amounts to seeing a URL change. If I actually do check the URL it points to, it's just to verify it's official/the actual repo or source I intended to trust. I was honestly never very worried about the attack vectors that are visible in PKGBUILD. Historically, with the rather popular AUR packages I install, any attack would be noticed rather quickly, which limits would-be attackers to those who don't care who they hack and don't mind it being short-lived. The threats I was more worried about were those from more malicious/advanced sources that would attack more subtly upstream – but if I've already decided to download and run a precompiled binary from a repo, I've already decided to accept that risk. In other words, in the past, I relied mainly on the goodness and vigilance of the community, only occasionally investing time to check myself on less mainstream packages or repos. Was this ideal? No. Was it sufficiently responsible? As it was my own machine and my own data at risk, I believe so. And to be honest, I've not had a single problem in over a decade of doing so. That's clearly got to change now, though.

skydhash 2mo ago

I used alpine linux and it looks pretty easy to setup your own repository, including build scripts for packages. I now use OpenBSD and the port systems of the BSD (each are different BTW) make it also easy to add extra software.

matheusmoreira 2mo ago

> the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over The maintainers you're supposed to trust are Arch Linux's actual staff made up of package maintainers, formerly known as trusted users. AUR packages are maintained by randoms on the internet. Anyone can sign up and push a package.

matheusmoreira 2mo ago

> I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Can't have it both ways. Your packages can come from a small number of trusted individuals who maintain the software distribution. Naturally, this limits your choices to the packages they personally maintain. If you need something outside of that set, you need to ask them to include it or source it yourself. Alternatively, your packages can come from a software repository that allows internet randoms to push literally anything. That expands your selection to all software ever created, which includes malware since nobody's doing the work to filter that stuff out. Arch Linux offers both paradigms. Make an informed decision.

numeri 2mo ago
I agree one hundred percent! Doesn't mean I can't wish I could have it both ways :)