AUR vs RPM Fusion, with regard to security

Ask Fedora
,
1

in recent months aur servers for arch linux got hit multiple times with trojans and viruses put there by users who saw a low hanging fruit and went for it, making the repo made by arch users a big no

recently i needed to use rpm fusion, the non free one for the video codecs to play videos, that got me thinking, what is the security of rpm fusion, i understand that it is not a repository maintained directly by fedora but not exactly like aur one, so that got me thinking on security and installing a trojan in my pc, perhaps someone could comment on how that part is handled here or if i should stop using rpm fusion, just in case

3

I have been using Fedora and rpmfusion for many years and have had no issue’s.I can not remember anyone mentioning here or anywhere online with any non secure programs on rpmfusion. I also use Arch and have some app’s installed from the aur with no issue’s.The issue with aur was a lot of app’s that had not been updated in years and developers that are no longer around.Someone managed to use the absent developers logins to introduce malware into certain programs.It was taken care of very quickly and I did not here of anyone being infected.It does also come down to pay attention to whats downloaded and if something does not look right do not use it.

4

we are humans, we make mistakes, many years ago i was on a distro that added a game to the repo and it had a virus in it, humans making mistakes vs people dishonest doing a mess

so if i understand correctly, rpm fusion is sort of in the same boat as aur? users with access to repo and not maintained by the distro?

5

A lot of what is in rpmfusion is maintained by people that help develop Fedora Red Hat Centos etc. As far as the aur even Arch does not support it or recommend it but they do help maintain the repo.There are 1000’s of app’s in the aur. Myself I find that Fedora and rpmfusion are very secure.

6

yes, fedora and security is a image present, for sure

the situation here is that one must doubt of everything now

the nature of rpm fusion, how it has been described is that it holds what you cant have on the distro or official repos, mostly for the non free stuff, so it is good to keep n mind that

i never used a arch based distro, so cant talk about it, but recently i used a ubuntu/debian based distro and sort of prefer fedora style, it has its problems, as any distro, but is quite nice

7

Aur has a number of issues that make it’s security problematic (from what I have read).

  • the maintainers are not verify
  • Orphaned packages can to taken over by anyone
  • A bad actor can add an override for a arch package
  • When you enable aur you are exposed to every package on aur

Rpmfusion has none of these issues.

The nearest thing in the fedora world is copr.
By design it avoids a lot of the issues that aur has.

  • you have to enable each copr repo one by one which avoids exposing yourself to all packages
  • orphaned packages are far less of an the they are on aur
8

thank you for sharing that information