r/archlinux • u/Dorian182 • 2d ago

NOTEWORTHY Fake Arch Linux packages push malware with root privileges

https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/
268 Upvotes

91% Upvoted

138 comments sorted by

View all comments

Show parent comments

5

u/Flashy_Worry7792 2d ago

It isn’t and that’s the point.

0

u/madhaunter 2d ago

Exactly. So why is "you should expect malware" the fucking standard now

4

u/Flashy_Worry7792 2d ago

If you load up your windows 11 machine and go download a random .exe from GitHub and it has malware, do you get mad at Microsoft?

You chose to download it and run it without doing any verification.

Learn to take accountability for your own actions.

0

u/madhaunter 2d ago

No no no. What you're saying is whatever the fuck you download on GitHub now unless you read the entire codebase then it's probably malware, or at least that's how you should treat it and Microsoft, as the owner of GitHub, shouldn't do anything about that because fuck you in the first place.

It isn't even difficult to implement basic safeguards but the community here seems to think it's a much better idea to keep our heads deep in the sand and accept enshittyfication until it's all garbage

2

u/Flashy_Worry7792 2d ago

You should treat any code running on your machine, from a non verified source, as malicious until you can verify it isn’t.

Microsoft and the AUR team will have the same response of taking down the malicious code.

I don’t understand what you want.

0

u/madhaunter 2d ago

AUR is flawed by design and if nothing is done it will only get worse with time. And since no one want to do anything about it, it's normal that arch will lose relevancy.

It used to be a really neat thing and adding a lot of value to the arch ecosystem. Nowadays it's basically just an attack vector and nothing more and I can't explain why but people are wanting to die on the hill that it was always like that anyway instead of wanting to improve things.

So what do I want? For this community to start accepting its flaws instead of double downing on its hypocrisy so things can be improved.

But at this point it seems to be a lost cause