paranoia about an aur malware check script

[u/urixity]

I really wanted to check my aur packages and see if theres something so I installed this: https://github.com/lenucksi/aur-malware-check

I'm not good in reading code, so if someone can help me and see if it's fine this would be great help, thanks! (and yes I get it "don't download random scripts from the internet, I know that but I'm just very, very stupid ok.)

[u/agowa338]

don't run random scripts off of the internet that you don't understand. That's how you get malware. Yes, even when it claims to scan for malware...

[u/ehr1c → u/agowa338]

Honestly seems like one of the best places to put malware, lol

[u/czerilla → u/ehr1c]

Time to work on a malware-script malware checker. That should alleviate all these concerns, once and for all.. 😎👌

[u/Excellent-Love-6943 → u/czerilla]

Make it self-checking so that users can know their malware script malware checker script doesn't have malware.

[u/urixity → u/agowa338]

I said that I understand, there's no need to lecture me

[u/aesvelgr → u/urixity]

Not every piece of advice is immediately a “lecture.”

You’re not stupid. You can read it yourself and then figure out if it’s malicious using your own understanding. And you should too, because that’s a part of learning how to manage your own system.

[u/Excellent-Love-6943]

If you can't audit pkgbuilds yourself, you have zero business running them.

[u/One-Luck7149]

aww shit, that hits my AUR paranoia. Before the first one this year I got paranoid because I used to trust the maintainers. I thought they went through the whole process to determine whether they can be trusted or not. Reality is that no they don't, and with AI pretty much anybody can be a maintainer now. Also they could hack any of the trusted accounts at any time and upload malware. Shit is just not worth it anymore.

You either basically review the package before installing it, or install it from another source. Anyway there's no guarantee you're safe other than being mindful of what you install. At least I think we can trust pacman because it has higher control standards, but AUR to me is pretty much dead, or good only as a reference rather than a source to install apps.

Not trying to lecture anybody, but I've tried several things like using fucking bubblewrap, or nspawn-ing a debian distro on the side, and none of them would keep my computer safe if it's malware. Plus I don't like Wayland because it adds hardware delay to the mouse, so x11 is unsafe at all times.

[u/urixity → u/One-Luck7149]

i might trust it since theres multiple reddit posts about it saying its fine, but i really dont know, i dont know enough python.

[u/One-Luck7149 → u/urixity]

Just to put that into perspective, even AI failed to detect malware on some packages, so it's not matter if you are proficient in a programming language it's more of having the secOps experience to detect that. Also, I wouldn't want to put at rist my email credentials, my discord, social media, etc. These guys will try to fuck you up in any possible way, no second thoughts, they have no heart for their victims.

[u/urixity → u/One-Luck7149]

well fuck, i dont know what to do

[u/bassamanator]

I remember going over that repo when the aur was compromised, it didn't appear to be going anything dodgy.

Having said that, you have to trust me to believe the above, and, or, my ability to read and understand code.

Anyway, I use the same repo, it's fine.

[u/urixity → u/bassamanator]

im sorry youre the only comment that trusts this between like 5 other comments my brain or my gut wont let me trust you.

[u/bassamanator → u/urixity]

So you can't read anything eh, it's not just code? You shouldn't use the repo if you don't trust me; why would you, you don't know me.

arch is not for you if you can't understand three short sentences (although I apologize in advance if English is not your first language).

No need for sorrys, I don't care one bit if you use the repo or not.

[u/urixity]

also if it matters ill add, I didnt run it as root, and it didnt require root privileges, like a password or something