What happend to AUR

I

ioverreact

Hi everyone,
potentially silly question coming so please delete this if it is irrelevant and accept my apologies in advance.

Given what has happened to Arch linux in the last few days, it made me wonder if something similar could happen here?

Are the ports checked/guarded to keep them free from anything dangerous or is the onus on the end user to check them or take them on trust?
 
matt_k said:
What has happened to Arch linux?
And this should be in the offtopic category.
Click to expand...
AUR got compromised. Malicious actor has updated more than 1500 orphaned packages with malware. And yes, it can happen on any distro or BSD. Perhaps not at that scale, but it can happen. Supply chain attacks are very common today. Get used to it.
 
Watch this talk as it will answer your questions / concerns (audio is missing the first 40 secs or so)
View: https://www.youtube.com/watch?v=ZGmuZz5ETHs&t=19276s


While a committers is supposed to review patches/commits before pushing to the tree there's certainly room for discussion whether that process needs to be tightened and be more carefully evaluated.
Edit: There have been no progress / discussion this since this talk about these issues
 
diizzy said:
Watch this talk as it will answer your questions / concerns (audio is missing the first 40 secs or so)
View: https://www.youtube.com/watch?v=ZGmuZz5ETHs&t=19276s


While a committers is supposed to review patches/commits before pushing to the tree there's certainly room for discussion whether that process needs to be tightened and be more carefully evaluated.
Click to expand...
spot on thank you. I ask because there are various models available and I always ask the question "who is paying the bills?". If the devs providing the free software are being paid by a company making money on enterprise products, they're very unlikely to introduce malware. If they're not being paid, then what are their motives? I know there many people who very generously devote their time to helping with open source projects, but lets be realistic, there will be just as many looking to make money by introducing malware.
 
diizzy said:
If you carefully read the post there's timecode (below the "thumbnail"), if you want to complain about how the forums parses links do it to the forum admin.
Click to expand...
at least you tried to answer my query without being snotty. It was very much appreciated 😊 The attitude of individuals like MrBSD are the reason take up is and always has been slow. Lets keep up the positivity and ignore basement dwelling trolls like MrBSD.
 
You must log in or register to reply here.
Back
Top