Well, I guess I'll avoid updating for the next few days. A bit worrisome that I did so last night.
I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over.
LLMs make large scale and long-term attacks easy and cheap. You could (and if I was a three letter agency, I would probably do so!) maintain ten thousand packages as three thousand separate "individuals" for years before cashing in the trust you've built up.
> naively and gratefully trust in the armies of volunteer maintainers is over
I'm almost scared to ask, did you not even review the PKGBUILD or anything else before installing stuff from the AUR?
Nixpkgs has a completed different model compared to AUR, the changes that end up in nixpkgs are all reviewed by maintainers, while AUR is literally free-for-all "anyone can push anything at any time", I don't think you ever could "naively and gratefully trust" AUR in the way you might have been.
> did you not even review the PKGBUILD or anything else before installing stuff from the AUR?
I'd venture most people actually don't review pkgbuild; especially on upgrades.
The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned.
You can even hide nefarious code in the compilation/build steps, Jia Tan style.
Cool theory, but the same reason I pull my shoes off by standing on my heel and pulling, despite it saving me no time (I will have to untie them anyway when I put them on again).
Humans are short sighted, want to solve the situation immediately and will do the laziest thing possible to accomplish a given task.
> I'd venture most people actually don't review pkgbuild; especially on upgrades.
No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?
> The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned.
Sure, that's why when you review the PKGBUILD, and instead of it using the official GitHub organization / domain (which you of course validate) for downloading the binary/source, you don't install it.
I agree it's still vulnerable to Jia Tan style attacks, but installing from AUR is essentially "curl http://random-website.com/script.sh | bash", and reviewing a PKGBUILD takes a few seconds, and stop/cancel if something is sus, it's really that easy.
> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?
I would assume essentially everyone? `curl https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from the internet into bash.
> reviewing a PKGBUILD takes a few seconds
This assumes a naive attack that is easily visible from the PKGBUILD. Unless the attacker makes no effort to hide their activity, the PKGBUILD will look perfectly ordinary while still installing malware.
What PKGBUILD referencing official sources that been attacked would not be easily visible? The second the source changes away from official sources, you stop installing from it. It's one line you have to review, usually pointing to either a Github release or a CDN/download host under the official domain.
> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?
That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine.
A decade of telling people that if they don't update constantly they're at risk, also affects us computer people.
Being able (and willing) to inspect source tree is the exception here, not the standard.
> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine.
Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure.
AUR is a very different thing from this, where essentially anyone, at any time, can become a "mirror" and host whatever code they want, with zero review.
I obviously don't review stuff when I use pacman and official Arch package repositories, because again, those aren't "Wild west of random binaries", like the AUR.
> Me. Who reads the source code of every program they run?
No one. Who codes their own operating systems before they launch a calculator on their own computer? No one as well. Why the irrelevant questions? They're all very different things.
You literally have to review one line, that points to a remote URL somewhere, that's it. If it's wrong/sus, don't install it, you don't even have to review more than that.
I used alpine linux and it looks pretty easy to setup your own repository, including build scripts for packages. I now use OpenBSD and the port systems of the BSD (each are different BTW) make it also easy to add extra software.
Sadly, this is the future of a lot of FLOSS development unless people start to see their projects as their legacy instead of a simple hobby or a way to scratch an itch.
Once your project obtains any sort of real notoriety, it starts having a blast radius, and you need to have at least some idea of who is pushing what to it when and why. The Linux kernel has a pretty good system of this for the time being with Linus being BDFL. There's governance, there's a standard, and most importantly, there are resources coming in.
If your wares are being used by large groups of people you've never met and in ways you cannot possibly imagine, then it's time to start doing the boring paperwork and political parts of managing the community around it, not just pushing commits and adding features.
Well, I guess I'll avoid updating for the next few days. A bit worrisome that I did so last night.
I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over.
LLMs make large scale and long-term attacks easy and cheap. You could (and if I was a three letter agency, I would probably do so!) maintain ten thousand packages as three thousand separate "individuals" for years before cashing in the trust you've built up.
> naively and gratefully trust in the armies of volunteer maintainers is over
I'm almost scared to ask, did you not even review the PKGBUILD or anything else before installing stuff from the AUR?
Nixpkgs has a completed different model compared to AUR, the changes that end up in nixpkgs are all reviewed by maintainers, while AUR is literally free-for-all "anyone can push anything at any time", I don't think you ever could "naively and gratefully trust" AUR in the way you might have been.
> the changes that end up in nixpkgs are all reviewed by maintainers
They review the “recipes”, sure. But I don’t know if I’d trust that every diff of the source of every package update is reviewed by them.
> did you not even review the PKGBUILD or anything else before installing stuff from the AUR?
I'd venture most people actually don't review pkgbuild; especially on upgrades.
The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned.
You can even hide nefarious code in the compilation/build steps, Jia Tan style.
Why especially upgrades? Upgrades are way easier to review than new installs. Most diffs I see are just these two lines:
It takes like 5 seconds to read and press Y.Cool theory, but the same reason I pull my shoes off by standing on my heel and pulling, despite it saving me no time (I will have to untie them anyway when I put them on again).
Humans are short sighted, want to solve the situation immediately and will do the laziest thing possible to accomplish a given task.
pop each lace down one eyelet and you'll never have to untie them again if the heel is both sturdy and forgiving enough
> I'd venture most people actually don't review pkgbuild; especially on upgrades.
No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?
> The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned.
Sure, that's why when you review the PKGBUILD, and instead of it using the official GitHub organization / domain (which you of course validate) for downloading the binary/source, you don't install it.
I agree it's still vulnerable to Jia Tan style attacks, but installing from AUR is essentially "curl http://random-website.com/script.sh | bash", and reviewing a PKGBUILD takes a few seconds, and stop/cancel if something is sus, it's really that easy.
> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?
I would assume essentially everyone? `curl https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from the internet into bash.
> reviewing a PKGBUILD takes a few seconds
This assumes a naive attack that is easily visible from the PKGBUILD. Unless the attacker makes no effort to hide their activity, the PKGBUILD will look perfectly ordinary while still installing malware.
What PKGBUILD referencing official sources that been attacked would not be easily visible? The second the source changes away from official sources, you stop installing from it. It's one line you have to review, usually pointing to either a Github release or a CDN/download host under the official domain.
> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?
That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine.
A decade of telling people that if they don't update constantly they're at risk, also affects us computer people.
Being able (and willing) to inspect source tree is the exception here, not the standard.
> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine.
Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure.
AUR is a very different thing from this, where essentially anyone, at any time, can become a "mirror" and host whatever code they want, with zero review.
I obviously don't review stuff when I use pacman and official Arch package repositories, because again, those aren't "Wild west of random binaries", like the AUR.
Me. Who reads the source code of every program they run?
I've learned not to trust the AUR because the barrier to malice is lower, but I run system updates every other day.
> Me. Who reads the source code of every program they run?
No one. Who codes their own operating systems before they launch a calculator on their own computer? No one as well. Why the irrelevant questions? They're all very different things.
You literally have to review one line, that points to a remote URL somewhere, that's it. If it's wrong/sus, don't install it, you don't even have to review more than that.
I used alpine linux and it looks pretty easy to setup your own repository, including build scripts for packages. I now use OpenBSD and the port systems of the BSD (each are different BTW) make it also easy to add extra software.
for context, 2 days ago:
Arch Linux disables AUR package adoption (https://news.ycombinator.com/item?id=49123208)
Sadly, this is the future of a lot of FLOSS development unless people start to see their projects as their legacy instead of a simple hobby or a way to scratch an itch.
Once your project obtains any sort of real notoriety, it starts having a blast radius, and you need to have at least some idea of who is pushing what to it when and why. The Linux kernel has a pretty good system of this for the time being with Linus being BDFL. There's governance, there's a standard, and most importantly, there are resources coming in.
If your wares are being used by large groups of people you've never met and in ways you cannot possibly imagine, then it's time to start doing the boring paperwork and political parts of managing the community around it, not just pushing commits and adding features.
So another active attack? Does anyone have any other details?