(hopefully this doesn’t read as blaming the victims instead of the attackers but) I personally don’t think it’s that complicated to read the updates to AUR packages. It’s not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?
it’s bypassing the normal place to download (in the PKGBUILD) and doing so in a place that’s unsandboxed instead (in the .install file, not the PKGBUILD) when it didn’t need to do that before
i wouldnt know where to get the info in the first place. when i use windows update i also dont reed any changelog because that shouldnt be the users job but the suppliers
As an avid user of the AUR, you’d be correct if you were downloading from the official arch repository. But you aren’t. AUR is basically like downloading from github. The only “guarantee” you get is from whoever put the package up and its up to you to determine if they’re trustworthy.
The whole point of the AUR is that it’s just random people’s code. There is no supplier here. If you don’t know where to find that information, you really shouldn’t be using AUR.
that is indeed the official guides’ fault if they’re not in charge of helping maintain the AUR package. not the case for most of the infected packages here other than notably alvr, though.
(hopefully this doesn’t read as blaming the victims instead of the attackers but) I personally don’t think it’s that complicated to read the updates to AUR packages. It’s not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?
I don’t think it’s immediately obvious that the PKGBUILD installing some shit with npm is malware.
it’s bypassing the normal place to download (in the PKGBUILD) and doing so in a place that’s unsandboxed instead (in the .install file, not the PKGBUILD) when it didn’t need to do that before
i wouldnt know where to get the info in the first place. when i use windows update i also dont reed any changelog because that shouldnt be the users job but the suppliers
windows update doesn’t force you to take a look at the changelog. most AUR helpers do so you better bet that it’s important
As an avid user of the AUR, you’d be correct if you were downloading from the official arch repository. But you aren’t. AUR is basically like downloading from github. The only “guarantee” you get is from whoever put the package up and its up to you to determine if they’re trustworthy.
The whole point of the AUR is that it’s just random people’s code. There is no supplier here. If you don’t know where to find that information, you really shouldn’t be using AUR.
In an ideal world yes, but I needed some software that was only available via AUR and if the official guides tell me I can install it via AUR I will.
that is indeed the official guides’ fault if they’re not in charge of helping maintain the AUR package. not the case for most of the infected packages here other than notably alvr, though.