Hacker News Reader

Comment by fantyoon | Hacker News Reader

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?

I would assume essentially everyone? `curl https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from the internet into bash.

> reviewing a PKGBUILD takes a few seconds

This assumes a naive attack that is easily visible from the PKGBUILD. Unless the attacker makes no effort to hide their activity, the PKGBUILD will look perfectly ordinary while still installing malware.

View on HN

What PKGBUILD referencing official sources that been attacked would not be easily visible? The second the source changes away from official sources, you stop installing from it. It's one line you have to review, usually pointing to either a Github release or a CDN/download host under the official domain.

PKGBUILDs are more powerful than that. They might download dependencies for the build from a package registry like npm, pypi, or crates, they might download and apply patches, and run arbitrary build scripts.

Changes to some of that might be easy to catch, but if the PKGBUILD depends on external resources, it can be quite hard to audit. I am not saying this is good practice, but you can see these sort of things happen all the time on the AUR.

> dependencies for the build from a package registry like npm, pypi, or crates, it might download and apply patches, and run arbitrary build scripts

You're supposed to review every single one of those too.

Yes, indeed they might, but if you start seeing sketchy stuff like that, then don't continue, I'm not sure I understand what's hard here. Or do continue, but then if those are AUR packages themselves, review them as such. Personally I just ignore anything not built from official binaries/sources.

If the PKGBUILD depends on more stuff then just officially available things, don't blindly install it and wish for the best. Just like if you "curl | bash" install something, you do at least look at the URL right? It takes a couple of seconds, maybe tens of seconds if you don't recognize the domain/github organization since before.

Ah but you switched now from "I don't think people do this" to "people shouldn't do this". You're right about the latter but wrong about the former.

Yes, contrary to popular belief, even I am affected by context and change what I converse about as the discussions topic and context drift, this is called having a conversation.

I'll stand by that I think most Arch Linux users, extrapolated from the people I know also run it, review at least the domain/GitHub organization for random AUR packages, and all of them are aware of what the AUR actually is, and is for.

I don't think most people here on HN who are clearly misunderstanding what the AUR is, are actually Arch users, or if they are, they haven't read the header that been visible since forever on the AUR.

> `curl https://random-website.com/script.sh | sh` is one of the most common way of installing software

Sure wish GitHub READMEs hadn't normalized this.

Reply on news.ycombinator.com