AOS for Lemmy.World - A generic Lemmy server for everyone to use.

Australian Tech

Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

2011

3d 23h ago by aussie.zone/u/LantenCompass in austech@aussie.zone from www.phoronix.com

cross-posted from: https://lemmy.zip/post/66075617

How can it happen? Were the maintainers of all these 15xx packages brainwashed?

7 replies

AUR is user generated content and it isn't moderated or enabled by default. It is a place for regular users to share PKGBUILDS which are scripts that automated building and installing software. Hard to explain now as it belongs to a different time and ethos when most people in the FOSS community were trying to help each other and build better things. Sort of like how in small town Australia or NZ people all pitched in to help each other in old times and you didn't lock your house or car.

It was always drummed into Arch users that AUR was user generated and potentially unsafe (just from broken packages, not necessarily malicious) and to vet the content before use. But we got tools to make updating AUR packages too easy and even experienced users can get slack.

There are some high quality packages on AUR that will eventually be vetted and adopted as official and some that are very well maintained by trustworthy people. But there is also a lot of crap and packages that have been abandoned which can be claimed by a malicious org. That is the source of the crazy number of packages. The number of people compromised was probably very small but its a valuable lesson.

AUR is not too different to Microsoft owned github/npm which distributed most of the malware or to the various package managers that many software devs rely on far to heavily. Supply chain attacks will continue to be a huge threat as long as people are pressed for time and lazy and I don't think llms are going to be a magic bullet.

Thanks for that detailed description of aur. I came here to make a snarky comment because I use debian. But this could happen with any distro. Especially when using docker:latest images from random places.

I am a debian user as well. It's what I have used for servers and dev for over 25 years. No distro is perfect. Debian maintainers sometimes add too many patches to upstream and introduce bugs and vulnerablilities. This is particularly nasty when SSH is involved. One of the things I like about arch is how little the maintainers alter upstream. The memes about arch aren't much like the reality.

The intention of the AUR was really good. If you wrote an installation script for a niche package or with different build options you could share it with others and get some skills and feedback on packaging. It was like Ubuntu's PPAs but simpler.

Like anything good it just takes a few bad actors. We just can't have nice things it seems. The whole FOSS ecosystem is under attack and we are all in it together. Shit like XZ can get any of us. It's not really a good time for distro wars.

At least with a compromised docker package any malware insude needs to break through the virtualisation layer. Not impossible but not considered trivial.

With the aur you are compiling and running arbitrary code at the OS admin level.

I am a fan of the aur but try and use it sparingly. It often causes more problems than it is worth. I hate to admit it but this recent issue has made me reconsider the value of flatpak....

Big Walk - Release Date Announcement

4d 17h ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from www.youtube.com

1222

Repository > individual .exe

8d 13h ago by aussie.zone/u/LantenCompass in austech@aussie.zone

3533

A software engineer at Atlassian got laid off in March after 8 years. His response: a 38-minute YouTube video showing how the company's entire tech works, free for anyone to copy.

1mon 2d ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from medium.com

126114

Binary Lane down?

1mon 4d ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone

655

Still haven't upgraded to full fibre NBN? From next year, NBN Co will make it mandatory for some premises

1mon 6d ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.techradar.com

406

A world-first quantum battery charges faster when it gets bigger – but it’s tiny and only lasts nanoseconds

2mon 23h ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from theconversation.com

707

Australian solar forecasting technology shapes energy prices and keeps grids stable

3mon 29d ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.abc.net.au

508

iPhone 8 and Vodaphone

4mon 5d ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone

239

GW data centre for Mamre Rd?

4mon 8d ago by aussie.zone/u/bpalmerau in austech@aussie.zone from stories.theconversation.com

4310

Photovoltaic researchers at UNSW demonstrate best-ever results for emerging solar cell material antimony chalcogenide

4mon 19d ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.unsw.edu.au

16011

React and next.js users - upgrade now

6mon 5d ago by aussie.zone/u/imoldgreeeg in austech@aussie.zone from www.cyber.gov.au

8012

Over a dozen universities are using AI to catch AI — and getting it wrong

7mon 26d ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.abc.net.au

30213

Australian homes could soon be built by spider-like robot called Charlotte

8mon 9d ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.abc.net.au

1014

Here's every problem the teen social media ban will fix, apparently

8mon 27d ago by aussie.zone/u/brisk in austech@aussie.zone from www.crikey.com.au

9315

NRMA [and others] adds iPhone roadside help via satellite for iPhone 14 and up

9mon 4d ago by aussie.zone/u/Tau in austech@aussie.zone from www.mynrma.com.au

2016

The age assurance technologies under-16s could face amid social media bans

9mon 15d ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.abc.net.au

4017

Silksong's Sweet Success

9mon 22d ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from www.youtube.com

5018

Google admits anti-competitive conduct involving Google Search in Australia

9mon 3d ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from www.accc.gov.au

13219

NBN internet is getting faster in September: What you need to know

10mon 7d ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.gadgetguy.com.au

14320

Breaking: Apple and Google lose landmark court case over anti-competitive conduct

10mon 9d ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.abc.net.au

21621

This GP uses AI with almost every patient he meets

10mon 15d ago by aussie.zone/u/Eyekaytee in austech@aussie.zone from www.abc.net.au

7422

Big tech says AI could boost Australia’s economy by $115 billion a year. Does the evidence stack up?

10mon 18d ago by fedia.io/u/MHLoppy in austech@aussie.zone from theconversation.com

8623

How Youtuber Louis Rossmann's beef with an Australian PlayStation repair whiz revealed a shocking past

10mon 2d ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from www.abc.net.au

71024

Australia grants major project status to 6 GW power export plan

11mon 15d ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from www.pv-magazine.com

6025

Cyberattacks could exploit home solar panels to disrupt power grids

11mon 18d ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from www.newscientist.com

11026

Australians will soon need their age checked to log into online search tools – here’s why

11mon 18d ago by fedia.io/u/MHLoppy in austech@aussie.zone from theconversation.com

16227

Adelaide Free WiFi

11mon 26d ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from www.experienceadelaide.com.au

4228

Sky Muster - Australian Satellite Internet (StarLink Alternative)

11mon 21h ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from www.nbnco.com.au

11629

Apple to Australians: You’re too stupid to choose your own apps

11mon 3d ago by fedia.io/u/MHLoppy in austech@aussie.zone from www.eff.org

25330

Telstra launches Australia's first direct to satellite text messaging service

1y 20d ago by aussie.zone/u/Tau in austech@aussie.zone from www.abc.net.au

11331

Aussie businesses now have to fess up when they pay off ransomware crims

1y 20d ago by fedia.io/u/MHLoppy in austech@aussie.zone from www.theregister.com

22132

Reject mail that does not have a DMARC policy enabled

1y 21d ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone

5133

NASA just performed a 'miracle save' for its farthest spacecraft

1y 1mon ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from mashable.com

17034

A privately developed Australian rocket is ready for a historic launch

1y 1mon ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from arstechnica.com

25535

World’s Largest Battery-Electric Ship Launched in Hobart

1y 1mon ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from tasmaniantimes.com

12036

Green steam and thermal storage startup reboots pilot plant after “tough lesson”

1y 1mon ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from reneweconomy.com.au

9037

Banking passwords stolen from thousands of Australians and traded online

1y 1mon ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.abc.net.au

341638

Household battery storage surges as plunging solar tariffs improve the economics

1y 2mon ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.abc.net.au

181039

Australian man survives 100 days with artificial heart in world-first success

1y 3mon ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.theguardian.com

26040

Australian Mobile Phone 'pay as you go' recommendations

1y 3mon ago by aussie.zone/u/Gorgritch_umie_killa in austech@aussie.zone

4841

Melbourne start-up launches 'biological computer' made of human brain cells

1y 3mon ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.abc.net.au

9142

Telegram says it will appeal $1 million fine from online safety commissioner

1y 3mon ago by fedia.io/u/MHLoppy in austech@aussie.zone from www.sbs.com.au

8043

Building the world's largest electric ferry | ABC News

1y 3mon ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.abc.net.au

11044

Microsoft's Windows 10 move could drive landfill surge

1y 4mon ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.abc.net.au

631845

New CSIRO technology detects more than 20 mysterious signals in space

1y 4mon ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.abc.net.au

19846

Telstra to trial satellite-to-mobile services with Starlink [starting with SMS]

1y 5mon ago by aussie.zone/u/zero_gravitas in austech@aussie.zone from www.itnews.com.au

6047

Tech whistleblowers urged to come forward and expose corporate wrongdoing

1y 6mon ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone from www.smh.com.au

33548

Australia's Social Media Ban (Coldfusion)

1y 6mon ago by aussie.zone/u/Longmactoppedup in austech@aussie.zone from www.youtube.com

5149

ChatGPT, Meta and Google generative AI should be designated 'high-risk' under new laws, bipartisan committee recommends

1y 6mon ago by fedia.io/u/MHLoppy in austech@aussie.zone from www.abc.net.au

9050