Just a heads up–the same user responsible for the RATs in the fake firefox/librewolf/zen packages uploaded a couple more packages today with install scripts that would’ve installed RATs. One was “google-chrome-stable” and the other was “chrome-bin”. There might’ve been a third but I don’t remember seeing what it was called before it was pulled.
The malicious install scripts were hidden pretty sneakily as well so reading the pkgbuild for chrome-bin, it only appeared to pull from debian stable’s chrome. Just another reminder to not only read the pkgbuild but sources and everything else
At least with older packages already installed there’s a bit “peace of mind” as stated in the article… I already tried to reduce usage of AUR packages, but for convenience… you know…
These evil, bored people driving me nuts. Should take their energy and knowledge and fix bugs!
Arch is rubbish and it already lacks modern security features like selinux and besides that it would take a team of people likely years to fully take advantage of it since most people will never fully understand it and apparmor is basically doing nothing without more effort and additional steps which can also take some time without a team of people improving it for everyone. Arch has been last to adopt other security features over the years also. These rubbish packages that arch allows should just be dropped, removed and blocked from the distro since only trustworthy sources should be used and warning people about the dangers is not enough since people have no idea what is safe and will use the rubbish unsafe packages anyways.
I think he may have a point about Arch Linux and security, would be nice to have selinux support on Arch Linux. I tried it once but made my system unbootable because you also have to setup all the custom security policies to make it work. But I don’t think he understands AUR PKGBUILDS because he mentions that those packages should be dropped from Arch Linux.
There is the voting system that ideally helps packages get promoted.
But yes, a lot of the popular AUR packages are there because they kinda have to be.
Just take a look at the highest voted ones and you will notice that with a few notable exceptions, like yay and octopi, that the vast majority of them are proprietary and/or do not allow redistribution, etc.
