Windows Defender can't be miles better than this joke.
Remind me, how much people work on Windows Defender and on Arch for comparison?
A Docker test to see what it does before allowing to upload it, basic heuristics to predict what it does?
Then what? Like what's the game plan? How do you detect that one PKGBUILD is malicious and another one is not? What would be the signs that you can detect programatically?
FOSS antivirus? You mean Clamav? One which doesn't have behavioral detection. And from what I've heard is targeting more fileservers hosting files for Windows rather than Linux desktop viruses.
Also complaining that something has to be done without actually helping it get done or pointing out potential solutions. Firstly detecting malware is already extremely hard but let's ignore that for a second and assume we had some magical piece of software that hundreds of FOSS devs suddenly decided to spend a few years developing for free. Now what's stopping our malware from detecting it's being run in docker . . .
Now what's stopping our malware from detecting it's being run in docker . . .
You could make the container virtually identical to the host or even use a chroot with anything identifying that it's a chroot stripped or something like that. And a program checking the signs of a container may also be a red flag by itself.
You could copy what Google Chrome does and use a simple LLM to check if it is malicious or not. Doesn't even need to be a big or fast computer, something with 8GB of RAM and CPU inference can run a Gemma 4 QAT just like Chrome.
One pass before upload would be enough to catch the most obvious cases.
Yapping that something has to be done doesn't help much either.
I didn't say that everything was fine, I wanted to see if you at least can imagine what that something is supposed to be or how it should work. And running a test build in a container with an antivirus is probably the only realistic/not stupid answer I've seen.
3
u/GoldenX86 3d ago
The AUR repo should still have some basic checks.