Arch Linux Trojan Packages

banger

brent I know you didn't ask me but the creator of clamav abandoned it last year

A quick google seems to turn up ClamAV by Cisco.

Harvey

It was clamtk, a frontend for ClamAV which was abandoned last year https://github.com/dave-theunsub/clamtk/issues/163

banger

Shame I liked ClamTK.

riffer

I still use ClamTK on my NAS but I'm too lazy to just learn the commands. 🙂

SilverBird775

Not an AUR user. Yet downloading some random binary stuff here and there.

Linux is still better then windows. Why on Earth any windows installer is asking for a system change privileges? Why asking?! It's installer, so you can newer say is it legit or not. There is no choice, you just hitting yes and hope for best. It's really so confusing that WINE does not even bother to simulate any sort of UAC control and just let ruin its prefix to any malware.

And yet there is no software in Linux that asked me for a root so far. Except updates of course. Oh, and partition managers.

AlphaElwedritsch

I don't use AUR in solus, so I don't have any problems with trojan packages 😉

Axios

What happens on the GitHub repository side when something like this happens.

brent

Axios
good valid question https://github.blog/security/github-advisory-database-by-the-numbers-known-security-vulnerabilities-and-what-you-can-do-about-them/

It's looks like they are active on it...except I don't know if they block the stuff from being downloaded or simply bringing it to your attention via "github advisory database."

MS (github owners) can afford to "get on it" in this proactive way.
The Arch crew probably not so much. AUR exploitation don't seem to be as common as the flurry of instances at github (in a simple DDG search.) Great observation.
MODS: sorry if I veered this

Harvey

Github can and have removed intentionally malicious content in the past, it happened with the xz backdoor awhile back, they took the entire repository offline for an investigation. I think Github taking the whole repository offline did more harm than good. They impaired the project's ability to investigate themselves what happened as well as the wider community while Github faffed around for days.

They however will not remove content simply because it has a CVE and nor should they.

This is irrelevant to this latest AUR issue since Arch do not really use Github, its provided as a mirror not the primary source. It also doesn't matter where a user repository is hosted, it should be viewed by users as inherently untrustworthy. To use it safely you must be somewhat knowledgable and read the recipe before use, each and every time. There is no magic to save you from this and there never will be.

Axios

Its more or less being informed about stuff and asking questions help fill the voids
especially from people like Harvey that has dealt with it .
And understanding how that ecosystem works.
Who is willing to put his two cents in which I very much appreciate.
Also views users have about the subject.

Hope these little talks help others out to.
Keep up the good work team!

Solarmass

I never liked concept of AUR. And I don't use AUR on Arch btw.
I don't want AUR for Solus 😛

brent

Solarmass I don't want AUR for Solus 😛

not at that gigantic size...but I would love an inter-user package repo independent of The Solus Team, of stuff people have modified, compiled, and tweaked that can only be it/rm byeopkg.

that would take a lot of trust and policing. in the end it may end up being more trouble than it's worth. but maybe not.

The AUR gets away with this because Arch users (unpaid) have stepped up to do the policing/re-readings code.

[I do run AUR packages on Arch but I hate to say it: flatpaks much more stable. AUR stuff mostly behaves weird for me: zoom, epsonscan2, scribus, ungoogled chromium, etc and I have to uninstall after it's floundered and get the flatpak version. Not everything at AUR failed me...but enough has].

« Previous Page