31–40 of 234 posts
Obviously installing anything from AUR must be done cautiously and there have always been sketchy (as in improperly built/packaged) packages in the past but seeing actively malicious injections is concerning. I think there are two main problems with AUR: 1. it is a remnant of a slightly more egalitarian era in the open source history when you could generally trust 3rd party code and 2. orphaned packages can be adopte…
AUR doesn't guarantee security, its upto the user to use AUR & verify before installing anything, its very evident why arch is not used in enterprise solutions.
Arch is not used in enterprise solutions because of the AUR? Can't you just not use it?
Man, I never hear good security things about npm
Obviously installing anything from AUR must be done cautiously and there have always been sketchy (as in improperly built/packaged) packages in the past but seeing actively malicious injections is concerning. I think there are two main problems with AUR: 1. it is a remnant of a slightly more egalitarian era in the open source history when you could generally trust 3rd party code and 2. orphaned packages can be adopte…
There was never an era in which #2 was a reasonable policy.
This is especially gnarly as more people have been picking up arch distros as of late (like CachyOS).
I have 1,135 packages installed. Only 3 top level packages are from the AUR and 2 of those 3 are from the same author, they just happened to split their packages into a client / server architecture.
How a person 'adopts' 408 packages and controls their build scripts?
Earlier quoted context omitted.
It's not the AUR. It's the rolling release cycle, and probably even more importantly, lack of support options.
The AUR has absolutely nothing to do with the rolling release cycle
Be aware of false positives! I found I had two of these packages installed, clang19 and compiler-rt19, but due to my recent laziness in updating my system, mine were still the versions from July 2025 from the official repos before they had relegated them to AUR. You can check the build and install date with `pacman -Qi `. I run Arch Linux in a container (within Fedora Silverblue), but my plan for the future: - consid…
> Flatpak and Flathub terrify me I thought Flathub has a review and approval process. Does it fall short in some fundamental way? Any review process is more than the AUR and NPM are doing.
If your manifest is covertly injecting malware into the build it could be easily missed. Consider some of the manifests are simply downloading deb packages and unzipping them.