all your pacmans are belong to US government

Someone mentioned here a while ago that "everyone here says not to use yaourt, you should be using pacaur instead." Does everyone actually say this? I've only seen it this once, but supposedly yaourt has devestating security vulnerabilities, is this true? Now that I think about it, how secure are package managers in general and does the arch user repository really have issues as the old lainon suggested? Are any of you lainons actually worried about package manager security lol?

I remember about targeted package managers attacks for having people to install malware by packaging software with names that are similar to useful packages.

>>2643 Is there any documentation of that?

>>2643 Isn't this just an issue of using AUR in general or is this an actual issue with pacman/yaourt/cower? My suspicion is the former. There's an obvious risk in letting virtually anyone add packages, just like there's an obvious benefit. Also, the code for yaourt isn't massive and is fairly readable. Genuinely interested in a informed answer though.

There's a couple reasons, but mostly yaourt just doesn't build correctly in all situations. https://wiki.archlinux.org/index.php/AUR_helpers#Comparison_table

>>2642 AUR packages are basically original binaries and sources hosted by third party (Arch community). If you are super paranoid, import developer's keys let your pkgbuild verify downloads on updates.

I'm fairly paranoid about the AUR since anyone can submit a package and the approval process doesn't seem very rigorous, so I always read the pkgbuild before installing things. Never saw the appeal of using a helper script if I'm going to do that, though I suppose it could help if you have packages that need to be rebuilt often. Most of the stuff I have from the AUR is practically unmaintained though. Ultimately, installing packages without inspecting the install script might be an acceptable security tradeoff. It's not much more risky than the way most Windows users install software, and if you're installing something proprietary or without many eyes on it, you're probably more worried about the upstream maintainer than the guy who made the AUR package. >>2651 This actually shouldn't be the case most of the time. A good AUR package will fetch the source or binary from the upstream github or whatever, and only contain files like .service and .desktop if anything.

Just another case of RTFM tbh. This thread is soykaf and almost every post in it. You could've easily searched for this and found plenty of reasons why you shouldn't use yaourt. Get ready to be spoonfed like a fuarrrking child. https://www.reddit.com/r/archlinux/comments/4azqyb/whats_so_bad_with_yaourt/ https://www.reddit.com/r/archlinux/comments/5s7ojo/yaourt_explain_to_me_why_its_bad/ https://www.reddit.com/r/archlinux/comments/50z5pk/i_switched_from_windows_to_arch_linux_because/ https://bbs.archlinux.org/viewtopic.php?id=222767 And to actually be useful rather than being a dick and spitting links at you: https://www.reddit.com/r/archlinux/comments/5mer2f/psa_rebuild_all_aur_packages_providing_python/dc3q8t4/ This is exactly why you shouldn't use yaourt. It sources the PKGBUILD before you even get to view it which you should be doing. It does attempt to sanitize the PKGBUILD, but by its own admission is an attempt and still sources it beforehand anyway. >>2648 >Some helpers are known to source PKGBUILDs before the user can inspect them, allowing malicious code to be executed It's been like this for years. They show no signs of changing it. People are still using it. Wtf even /sec/?

>>2683 I think this wasn't about googling the obvious, it was about: >Are any of you lainons actually worried about package manager security lol? To which no I'm not because linux users and in particular AUR users aren't very malicious, and even when they are, most AUR packages are linked by developer's github pages hosting the code, so you don't have to check or verify much...

>>2683 >le spoonfeeding I don't mind helping novices, why do you have to be so hostile about it?

>>2643 >I remember about targeted package managers attacks for having people to install malware by packaging software with names that are similar to useful packages. >>2646 >Is there any documentation of that? I don't know if this has ever happened within the Arch ecosystem but here is an example of what >>2643 means. http://blog.npmjs.org/post/163723642530/crossenv-malware-on-the-npm-registry

>>2686 Not him, but it can be frustrating to deal with this daily. Think of being tech support for your dumb relatives and you would get it.

>>2683 >It sources the PKGBUILD before you even get to view it which you should be doing. It does attempt to sanitize the PKGBUILD, but by its own admission is an attempt and still sources it beforehand anyway. That's not quite right. What yaourt is doing is loading package metadata by trying to parse out all the `declare` statements from PKGBUILD and source only those lines. This is especially egregious because the Arch packaging format includes a plain old data file specifically for this purpose already (SRCINFO). >Get ready to be spoonfed like a fuarrrking child. In future try and actually understand the soykaf you are copy and pasting and leave out the condescending remarks.

>>2696 I wouldn't defend that to be honest. All the dude did was Google the question and dump the first few hits. He didn't even understand it well enough to summarize them accurately.

>>2696 >but it can be frustrating to deal with this daily. I don't feel frustrated at all and I deal with it daily. What I'm so confused about is, if people don't like "spoonfeeding", why still do it? And why be so angry about it? Beginners don't have the contextual knowledge or familiarity with concepts that an experienced person has, and you can't just say "look it up lol" when they don't really know what they're looking for. Whether you choose to provide the information or not, that's of course your choice, but don't be a dick about it. >>2697 >SRCINFO sadly very underused in most AUR packages.

>>2697 Haha! Egg all over my face. I knew some bash wizard would have to come in and dump soykaf all over me. Thanks for the clarification lainon. >>2686 >>2696 >>2704 I actually enjoy helping novices and I am my friends' personal tech support. They have different problems to solve and provide solutions for. I was just mad and the previous zero effort, no substance posts triggered me.

>>2695 This is what I was referring to actually

>>2683 >>2685 >>2686 >>2696 >>2697 >>2698 >>2704 >>2705 OP here, two things: 1. Never failed to be surprised by the positive endings arugments have on this forum, I was not expecting anyone to give a soykaf after mad guy got mad, and I was doubly not expecting mad guy to stop being mad, both are miracles on the internet. 2. I was, as suggested earlier, far more interested in whether other lainons gave a soykaf about repo sec. Maybe I should have italicized parts of the other questions or something because I know you can upload just about anything into the AUR, but I didn't know about /all other repos/ and care far more about whether you all even give a soycalfcow. Looks like a lot of you do tbh.

>>2707 >you can upload just about anything into the AUR That's one of the things that scared me away from Arch to be honest. >whether other lainons gave a soykaf about repo sec I've used Gentoo for a long time. The main portage tree is complete enough that I've never felt the need to roll the dice with untrusted overlays. >Looks like a lot of you do to be honest. I'll be honest, I haven't looked into package manager security as much as I probably should have. It kind of feels like nuclear war, I just don't want to think about it. I think it's a good topic to bring up though.

>>2709 >you can upload just about anything into the AUR >That's one of the things that scared me away from Arch to be honest. Arch doesn't allow you to use the AUR by default, and the AUR is just to facilitate pacman's management of installed stuff so that you don't have to manually find and delete files when you want to get rid of an application (as you would if you just cloned the git repo). The AUR is fairly safe as noted earlier, you only ever really use it when linked or given the command from an app's website itself. Most companies are the maintainers of their AUR packages, so there's not a lot of room for savagery.

>>2709 >I'll be honest, I haven't looked into package manager security as much as I probably should have. It's a pretty well-solved problem, honestly. On all the major package managers(apt, pacman, probably portage) everything is signed with PGP keys and they actually make an effort to build up a WoT between package maintainers, and often also with upstream. I'd be far more worried about people injecting malicious code into projects with very few eyes on them.

>>2715 >On all the major package managers(apt, pacman, probably portage) everything is signed with PGP keys and they actually make an effort to build up a WoT between package maintainers, and often also with upstream. It's all just random volunteers fetching, patching, compiling, packaging and distributing your software (cryptographic signatures only protect you from bad things happening in the very last step). And even if they are trustworthy, there is no guarantee that they know the first thing about securing their own systems.

>>2735 *Usually* package maintainers are people who are well-known within the community. Particularly for core packages, like the kernel and stuff, it's people who are "part of" the distro. Additionally, usually they have build servers and sometimes they have scripts that automatically pull upstream code, implement some patches, build it, and push it. So you only need to trust those build servers aren't tampered with.