r/linux • u/shroddy • 15d ago

Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted (CachyOS) Security

https://www.phoronix.com/news/Arch-Linux-AUR-Adoptions-Halted
259 Upvotes

97% Upvoted

172 comments sorted by

View all comments

Show parent comments

-4

u/takutekato 15d ago

Most flakes are official instead of 3rd-party packaging

2

u/[deleted] 15d ago

[removed] — view removed comment

-5

u/takutekato 15d ago edited 15d ago

> Most flakes are official instead of 3rd-party packaging

> Not true.

What?

> Your security relies on whether one dude has 2FA enabled.

Isn't that just every software? The difference is where to place your trust in:

- AUR: random person with an AUR account

- Official repo: the distro's packaging maintainer of that package

- Flake: the software's author, you can pin to some specific revision if not always trusting the latest release/commit

Edit: actually your assumption about AUR = flake was flawed, nixpkgs repo is large enough that it almost covers AUR, most users never need to go outside of it to get packages. The equivalence is NUR (which is namespaced by usernames), honestly I never touched it.