| ▲ | harvie 3 hours ago |
| 7+ hours into this and still no mention on archlinux.org webpage nor on aur.archlinux.org. Why??? AUR should have been blocked until user takes action to prove he knows about this. Eg. change AUR API URL slightly so yay/yaourt users need to look up what is going on. New API should have infrastructure for informing users and making sure they've read the message before proceeding. Especially when they're not even sure that all malware was found. Also there should be database of revoked/compromised AUR commits and there should be mechanism to warn user if they had it installed. |
|
| ▲ | Tharre 3 hours ago | parent | next [-] |
| No it shouldn't. You don't break everyone's workflow just because some people refuse to take basic security advise seriously. > New API should have infrastructure for informing users and making sure they've read the message before proceeding. How would that even work? AUR packages are just git repos, everything that AUR helpers are doing or not doing is not under the control of the arch maintainers. |
| |
| ▲ | harvie 2 hours ago | parent [-] | | > How would that even work? Are you seriously asking how would sharing short text notes over internet work? If you need to be 100% git-centric, you can have git repo for messages. Client will then remember last commit displayed to user and refuse to continue unless latest message was displayed. BTW some AUR clients displayed ArchLinux RSS feed before... Too sad the issue is not even mentioned in the RSS feed... | | |
| ▲ | kpcyrd 2 hours ago | parent | next [-] | | There's no shortage in ideas of how to make the AUR easier to moderate. A "quarantine button", an invite system, a request system for adoption similiar to how orphan requests work, code review attestations similiar to cargo-crev, pacing controls similiar to those in discourse. There is a shortage however of people skilled enough to implement them (with available time to do so). What we also don't have a shortage of is angry people in comment sections. | | |
| ▲ | hypfer an hour ago | parent [-] | | People have all right to be angry if basic responsible adult things like "quarantine the server spreading large amounts of malware" do not happen within the reasonable timespan that passed. Not even a news. A hint. Nothing. Radio silence. ___ There is a house. It is currently on fire (since over 24h).
So far, people have talked about how, conceptually, house fires are bad. You can still enter the house just fine. People saying "hey what about locking the door to not trap more people in it" are being shunned for the crime of breaking someones workflow. The owner of said house is nowhere to be seen. Passerbys stating "oh my god that house is on fire! get water!" are either ignored or reminded that there is no problem and they should move along. ___ Idk man. I don't think any of this is real. And I don't even use arch, lol. And after this thing exposed the institutional rot, neither should you or really anyone. Unless you like ending up locked inside a house fire. I guess they provide warmth in the cold harsh reality of the 2026 internet. | | |
| ▲ | kpcyrd 13 minutes ago | parent [-] | | The server actually hosting the rootkit executable is npmjs.com, run by a for-profit company, and they still take about 24h to act on our reports, while reported AUR packages have been processed in about 1-2h by people that work unrelated dayjobs on top of this, to self-subsidize their open source work. Sorry you're displeased with us not writing blogposts faster on top of all this. The situation is already exhausting enough without people like you. | | |
| ▲ | hypfer 8 minutes ago | parent [-] | | Look, man, I understand all that, but pulling the plug is something that takes at most 90s. Let's say 300s to add the "Warning: There is an attack. We're working on it. Systems are down for now" box After that, you have all the time in the world to prioritize dayjobs etc. It's not about dropping everything and fixing the root cause. It's just about taking stuff offline so that the immediate danger is mitigated. That is not too much to ask.
It's not "people like me" having weird opinions there. Shut it down. Then fix whenever there is time to do so. ___ But hey. Finally a statement from someone with some amount of position in the org I guess? I wouldn't want to be in your shoes for sure, but that's beside the point. Nothing here is unreasonable other than the ostrich-style incident response lack-of-process. And I don't mean stupid corporate process. I mean "common sense adults are in the room" process. Throw waterbucket at burning server reflex. ___ I mean I can see that your userbase absolutely sucks and could imagine that one would be scared of getting roasted for "interrupting their workflow", but this is not the way. Their workflow is irrelevant. As said, I'm all here for maintainer empathy, but only after the fire is put out first. | | |
|
|
| |
| ▲ | Tharre 2 hours ago | parent | prev [-] | | You seem confused about how the AUR works. There is no "client" like you're talking about that can show the user anything. There are AUR helpers, but these are completely unaffiliated with arch and the people running the AUR. The canonical, recommended way of installing arch packages is cloning a git repo, reading through the sources and then building it with makepkg. There is no client there that could show the user anything. | | |
| ▲ | harvie an hour ago | parent [-] | | how comes gitlab shows custom messages to my plain old git client then? for example when you rename gitlab repository, or push to new branch, gitlab injects custom text that you can see. Eg. with new URL or where you can create merge request on web, etc... | | |
| ▲ | Tharre an hour ago | parent [-] | | I assume you're talking about the "remote: " messages? I've only ever seen those on push operations, not sure if they're even available for clone. Maybe they'd be an option, but then the whole "making sure they've read the message before proceeding" part goes out the window. |
|
|
|
|
|
| ▲ | cmiles74 an hour ago | parent | prev | next [-] |
| I think a notice on the front page of the AUR would make sense here. IMHO, a blurb on the Arch homepage with a link to a notice on the AUR page would also help. If you don't want to list all known effected packages, at least recommend the official position that anyone using a AUR package should be reading every file of every package they use. |
|
| ▲ | StrLght an hour ago | parent | prev | next [-] |
| IMO if numbers on Socket.dev can be trusted, then impact seems rather small (luckily). It also makes sense — I know some packages from the affected list, they're heavily outdated and their upstreams aren't maintained anymore. Other than this — I don't know how many there are affected people in total, but AUR team probably has an exact number. I am also sure, they're doing their best to handle it accordingly to the impact. |
|
| ▲ | GCUMstlyHarmls 2 hours ago | parent | prev | next [-] |
| It is a bit disappointing to not see any mention anywhere official. I know its all volunteer work and extremely not fun at the moment, but it feels weird to not even have some sticky-no-reply on the AUR sub forum with a list of compromised packages. You have to instead try and scrape them up from around threads like here or reddit. |
|
| ▲ | well_ackshually 2 hours ago | parent | prev [-] |
| Are you paying maintainers for that, or are you just blindly demanding things from a piece of software maintained by volunteers before saying iT'S sO uNprOfEsSiOnAL ? |
| |
