Guide To Arch Linux User Repository Safety
ฝัง
- เผยแพร่เมื่อ 5 ก.ย. 2024
- The Arch Linux User Repository is one of the best resources we have available on Arch but being user submitted packages you should be wary of what you're downloading but luckily it's pretty straight forward.
==========Support The Channel==========
► $100 Linode Credit: brodierobertso...
► Patreon: brodierobertso...
► Paypal: brodierobertso...
► Liberapay: brodierobertso...
► Amazon USA: brodierobertso...
=========Video Platforms==========
🎥 Odysee: brodierobertso...
🎥 Podcast: techovertea.xy...
🎮 Gaming: brodierobertso...
==========Social Media==========
🎤 Discord: brodierobertso...
🎤 Matrix Space: brodierobertso...
🐦 Twitter: brodierobertso...
🌐 Mastodon: brodierobertso...
🖥️ GitHub: brodierobertso...
==========Credits==========
🎨 Channel Art:
Profile Picture:
/ supercozman_draws
#ArchLinux #Linux #LinuxDesktop #OpenSource #FOSS
🎵 Ending music
Music from filmmusic.io
"Basic Implosion" by Kevin MacLeod (incompetech.com)
License: CC BY (creativecommons...)
DISCLOSURE: Wherever possible I use referral links, which means if you click one of the links in this video or description and make a purchase I may receive a small commission or other compensation.
I would love to see the same mentality toward vim plugins. It seems like a lot of people got the memo on AUR packages, but not yet for vim plugins. Nobody reads the diffs :)
i am just downloading many random packages from aur and vim plugins and also things from pip,npm etc...
:) why could go wrong...
my secrets folder is 2 directory inside of other folders.... which only containing the number to my bank accounts, and some very sensitive information of job..... but nah... no body is gonna be interested in that boring things....
@@vaisakhkm783 Is it at least encrypted?
@@remrevo3944 file encryption? a lot of linux users are so blind they don't even think of enabling a basic firewall on their system, so I let you guess what percentage of users enable strong file encryption
@@atemoc There's rarely any point to having a firewall on a desktop system, though. That would be the job of the router.
@@lassipulkkinen273 If they would be configured properly....
Somehow, in some places, it's not the case
Even where I live it's not enabled by default on my router, I had to go in and turn it on myself
I unfortunately live in an area where we’re not taught about safety devices and safe “browsing”. My parents were uneducated about modern safe browsing methods and so I had to explore the aur for myself and make my own mistakes and deal with infections I was unprepared for.
Thanks for posting this Brodie I couldn’t resist the euphemisms.
/s
What? You blame your parents for not teaching you how to review AUR packages?
@@dand337 sorry forgot the /s. It’s a joke about safe browsing and safe “other things”.
I like using pamac as my AUR helper because I like how it DDoSes the AUR.
Spamming requests when using its gui
😂
11:27 Nah, if someone really wanted to ship malware, putting it only in the pre-compiled artifacts and not in the public source code would definitely be harder to detect. Also, the build machine could have been compromised, etc.
Still, if you don't trust the developer, you probably shouldn't be installing the software in the first place.
This
Most opensource binaries should be build with CI anyway. (At least I hope so.) In which case that wouldn't really apply.
@@octopusdreams One obvious way would be to use self updates to deliver and execute phase 2.
@@octopusdreams True. Though it's the most immediate example that came to me thinking about where to hide something like that.
Also in some cases the application and data it uses are updated separately and the second part is often not via package manager. (Even though it may be should.)
You're certainly not wrong. But if nobody used any software developed by people they don't trust (not to mention people they distrust), then Linux wouldn't even have a fraction of its user base.
Good basic instructional video Brodie. IMO, too much AUR will eventually break something on a newby setup. Always best to stick to the pacman repo as much as possible. When not possible, the AUR kicks butt and makes life quick and easy.
I never pull anything my system relies to function from the AUR. Only certain optional applications for specific tasks.
I use AUR as a Manjaro (GASP!!!) Unstable user.
I'm watching this, 'cause it was in my feed :P
Sweet, so to slip a keylogger into the AUR, I need to make sure the download URL, developer name, and install script check out. I'll assume nobody will bother to read the source if it's ugly enough.
Not that this isn't good advice - it's just a shame that I can't use my expensive sliver of magical melted sand to comprehend and manage what the package can or can't do. Like, we need a lavamoat for system packages.
I recently spent some time learning how to use steamtinkerlaunch & ended up needing to use the AUR to install it bc all the other options were WAY too involved for me, & I wondered about this kind of thing at the time! These are great tips; I think they'll be easy to remember and probably make me feel a little bit less like I could be playing with forces I don't understand, lol.
Thank you for this vid Brodie, starting to test Manjaro and saw a few things missing. Now I know a little more about what to watch out for
As someone who avoids using the AUR unless absolutely necessary, I think you may be overestimating how many arch users bother with the AUR and especially how many chose arch because of it.
true. the only aur package i have installed is a font lol
Good video, but it would be nice to show an example of an AUR that was malicious, and also show an AUR package that was unstable or didn't work correctly, as that is probably the most likely risk to encounter
Well I am an AUR helper user... Even on my arch homeserver I now use an AUR helper.
Just doing the updates and making sure the zfs scripts like sanoid stays up to date is reason enough for me.
So my tactic on the AUR and the mess you can get, is that I try to use it as sparingly as possible... But the ZFS snapshots stuff just became super needed to avoid data paranoia so...
Now i want to learn the same about flatpaks and snaps.
What is your paru config? The review screen with the file tree looks pretty cool
I was using the lf file manager, just set FileManager to lf in the config once you've installed the program
@@BrodieRobertson I see, thanks!
i want to see cli tools for installing aur pkgs doing more of these checks automatically. because when you really work it out, a lot of the stuff you are manually checking here in this video... it could be given output to flag and inform the user. kindda like a linting process. for example if the src repo url is not an identified domain or self hosted that could print out a notification line in a shade of yellow. to prompt the user to manually check. or if the github repo is a fork. or if the github username does not match the aur username. then how many comments. and can automatically score those aur comments with sentiment analysis tool. and the upvotes. and then if flagged for deletion that could be printed in red color. all so many of these checks can and should be automated. with verbosity levels as to how much details to print. and user settings to decide how paranoid you want to be.
another feedback on cli can be to tell the user if the package maintainer is not using or has not enabled 2fa. since this is also another good extra security measure. to stop insecure aur accounts from getting hijacked. the same thing should in fact also extend to the repo accounts of the src on github or gitlab. we need reporting that those upstream accounts where we are actually fetching the software from... the end user must also be told whether those developer accounts are being secured properly by 2fa. so that (again) the person downloading can decide and the ability to choose what their own local security policy is they want to follow. this is especially important for open repos like aur. were anybody out there can submit software and packages
I agree with the first paragraph, but 2FA really depends on the methodology used. If it's through a cell phone, then it's not actually secure and could even be a big headache if you have a malicious actor appropriating your phone. Sure, there are other methods, but nearly every time I've seen it pop up, it's been cell phone based and that's just wrong.
@@anon_y_mousse well sure. but that aint on me pal. nor ever have i suggested such things would be ok... in my entire life. so no, just because other people half ass it... does not follow that i am wrong.
just maybe i should have said mfa instead since clearly there should be no reason to put upper limit on the number of factors people can use. and it can be done more cleverly than merely that these days in combination with other protection meaasaures. for sure
the only problem i have ever had on the aur is an application that hasnt been updated in a long time and just doesnt do anything. nothing has ever broken my system
Great tutorial on how to critically think about what you are installing.
No thanks, i prefer [testing] [chaotic-aur].
The chaotic aur is an interesting case, a 3rd party repo full of pre-built community builds.
@@BrodieRobertson The only downside is it could get compromised, but that also applies to the Arch repos
Chaotic AUR has saved me a lot of hassle by precompiling most of the external packages I'd probably need.
Open Build Service is my go-to if I have an issue with building AUR packages
@@BrodieRobertson Yh it's awesome, been using it for a year and a half without any problems!
Back when I was using Debian, I wrote a utility in bash to look for packages using fzf (script ==> fzf to find the right package ==> install)
Nowadays I use a package called parui that works almost the same way (no fzf ☹️) and it's pretty great
It is dependent on paru afaik so keep that in mind
I dont know what should i choose? An binary AUR packages ungoogled chromium i.e ungoogled-chromium-bin OR a repo from Opensuse special for Arch Linux. Github page from both sources are the same.
I am using the opensuse one.
Now it seems that finally is in the AUR so I will switch to the aur one
i use the flatpak for that one
Yes, I like this video! 👍 Thanks!
I see many people stating that they barely use the AUR and I simply don't trust them. There's basically no benefit to Arch when we discard the AUR. There are plenty of up-to-date distros like Fedora that would get the job done better than AUR-less Arch
Fedora is janky as hell though...
I don't use aur
heres how i keep myself safe when using the AUR. 1. Clone the AUR repo. 2. edit and modify PKGBUILD and get rid of libsystemd,systemd dependencies, 3. then install with makepkg -si. Systemd for most if not all of the packages are just garbage and basically unnecessary for package functionality.
you can also use Obarun, for that totally systemd-less Arch distro (unlike Artix,Void which still uses systemd for non init stuff)
I have no idea why I am watching this video - subscribed.
Not to heavily actually, most of the packages are actually from the main repo or chaotic-aur
What if the maintainer of an already installed aur package changes and the new maintainer suddenly does "bad things" ? You should "always" check that everything is still OK before you update an already installed package!
I like to listen to the high-pitched voice of this boy 😅😅😅
What kind of tea do u drink bro? im sipping on some chocolate mint right now but in the mornings i do love me some earl grey or english breakfast :)
English breakfast is pretty good
Now WHAT I DO WITH 1000s of PACAGES i installed from aur with out looking at anything.... :(
cry
@@BrodieRobertson 😣
I have a few aur packages and I host the code on my own server. I have no idea if anybody has actually read the code to see if it's actually not malware.
They almost certainly haven't
@7:05 can you do a video on the hikarujs package it looks interesting.
If installing random software is wrong, watching random YT videos (like this one) must be wrong too. 🤔
I need to rethink my entire internet usage.
Difference is knowledge can't harm you
@@BrodieRobertson That's far from true. Knowledge without understanding is very dangerous.
A running quote in my family for years was "I/you know just enough to be dangerous".
@@ChrispyNut it's not the knowledge that's dangerous it's the actions you take with it. You can know how to make sarin gas, the doesn't mean you're going to take out a city
@@BrodieRobertson It does if you don't know the dangers it poses or understand the effect it has or how it spreads.
@@ChrispyNut but that only matters if you use the knowledge
You know, training an AI to scan the AUR for malicious pkgs and flagging them would be a tremendous help. Just saying...
When you install on paru you don't need the -S
the AUR is 100% safe, no problem what so ever, just as safe as android's store :D ..... I use Arch BTW
Personally, I have no idea why I watched this video. I mean I basically do the same thing with npm packages, so I guess I agree with you magic arch man.
so for every package you want to install from the aur, you should audit the package build script? sounds like a bit of a hassle.
is there any kind of reputation or rating system for aur package authors? or is that too easy to game with bots?
I spent the first half of the video talking about that lol
Is that really a hassle though? I have maybe a dozen or two of AUR packages installed and it wasn't that hard. Even initially when I'd downloaded a good chunk of that at once.
And since paru can display diffs when updating, it's pretty easy to keep up with any changes: mostly the version number, a couple of hashes and occasionally a couple of different commands..
Also, this gives you a really good idea of the quality of these packages, where they dump their files, and so on. I sometimes decide not to install some packages because I can see they're crap lol
I am a fedora user, and I feel it's kind of, unnecessary? But hey good luck
virgin check install script vs chad test build installer
The thing I don't like about aur is that some people put there their work and you are unable to install it because it asks for password. Why is it then there?
What do you mean? The only AUR packages I know of that would have a credential form are things like Factorio build script or something.
@@mskiptr Long time ago i tried to install some sddm extension (if I remember corectly not sure if it was sddm) and before cloning repo it asked for credentials. Link in pkg build was referring to github page that doesn't existed or maybe was private. But pkg build looked ok to me. Eventually I didn't care and move on.
@@darukutsu Oh, that is something that GitHub indeed does AFAIR
Basically, that AUR package was broken. The repo owner (re)moved it or maybe made it private and now GH asks you to log in to check if you maybe have some special access rights. Such package is pretty useless on the AUR so unless someone can fix it, it will sooner or later get removed.
If it's like that the package should be deleted, only things that other people would want to use should be on the aur
review launches lf? do share this.
Just set FileManager in the config to lf
just use nixpkgs bro
Eyy you are
8:30
Do You Wanna my Sincere Opinion? Arch Linux Sucks..its just a "Linux Mint Slackware For Hipsters",this distro is for Masochists thats wanna be cool,but never will be cool....The Real World Linux distros are 100% muche Better....
linux mint slackware? what are you even saying?
Is this an AI comment?
@@clankfish Its is Difficult to usee and cult-like The Slackware Cult....And its a" Break dancing' distro
@@BrodieRobertson No Is Not...Arch sucks...you americans Choose the Worst Linux Choice to"play the Dungeon Master Nerd Hipsters"Years Ago was GNU libre Stuff...Now there is another Cult of Fools...You Use Arch By The Way...Go back to The Forest Help you"Gnome friends"you Leprechaun....
@@BrodieRobertson Maybe the original commenter snorted Ubuntu, ingested Fedora, and injected themselves with SLS. And the comment was the result, as well as a hangover.
i used arch btw
V
github cody_learner aurch