Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Installing Every Arch Package

ta180m.exozy.me

Post reply on HN
Print view View original

71–80 of 90 posts

Re: Installing Every Arch Package

#71

Post by akerl_ »

xyproto wrote: post #64
seanw444 wrote: post #48

Earlier quoted context omitted.

It's only a matter of time. Linux really only has a good malware track record due to lack of popularity.

All official Arch Linux packages are curated, and the unofficial ones are ~40 lines of shell script, with a voting system on top. These mechanisms for filtering packages are normally not present on systems that are plagued with malware.

The unofficial ones are ~40 lines of shell script that generally start by pulling down a VCS repo or tarball from somewhere. They check the checksum of tarballs, but if you’re pulling from the AUR you’re trusting not just the ~40 lines but also the much larger body of code that’s getting fetched.

Re: Installing Every Arch Package

#75

Post by conaclos »

theandrewbailey wrote: post #59
conaclos wrote: post #33

Please, stop using heavy images: bloated-kde.png is 3.2Mb... The image is still loading in the moment of writing... Same note for the website logo: render-small.gif is 4Mb. Still loading...

It seems that the site has changed. I'm loading less than 600k for this page (scripts, images, fonts... everything).

Yep: every image is now in webp.

I am glad that my comment improved this website :)

Re: Installing Every Arch Package

#77

Post by bee_rider »

For some reason I feel bad downloading too many unnecessary packages from these volunteer projects. I guess any given mirror must have enough users that even something like this is just a raindrop in the ocean, though?

Re: Installing Every Arch Package

#78

Post by native_samples »

I can think of a use for this.

If you can make a system work properly with every package installed, then you could in theory get rid of the concept of installation entirely. Use a FUSE file system to make it appear as if every package is installed, and then block any program that opens a non-installed file until the package has been downloaded and installed for real. Now you don't have to know about packages or pacman anymore. Just do ls /usr/bin to see what's available in the index, and then type in what you want and hit enter. Wait a few seconds and the program will start.

However, for this to work, does require that the system be stable with every package "installed" simultaneously, so it'd mean fixing UIs that assume only a few options are available.

Re: Installing Every Arch Package

#79

Post by sudosysgen »

akerl_ wrote: post #71
xyproto wrote: post #64

Earlier quoted context omitted.

All official Arch Linux packages are curated, and the unofficial ones are ~40 lines of shell script, with a voting system on top. These mechanisms for filtering packages are normally not present on systems that are plagued with malware.

The unofficial ones are ~40 lines of shell script that generally start by pulling down a VCS repo or tarball from somewhere. They check the checksum of tarballs, but if you’re pulling from the AUR you’re trusting not just the ~40 lines but also the much larger body of code that’s getting fetched.

No package maintainer is verifying the code of every update of the software they're packaging. Those 40 lines of shell script are the only relevant difference between packages and the AUR, security wise.
Post reply on HN