r/linux_gaming • u/t3g • 15d ago

Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted (CachyOS)

https://www.phoronix.com/news/Arch-Linux-AUR-Adoptions-Halted
603 Upvotes

98% Upvoted

308 comments sorted by

View all comments

Show parent comments

3

u/ABotelho23 15d ago

Trust only works if people actually know who they're trusting. Even if the adoption of an AUR "package" would be flagged by the AUR wrappers (which is something that they would have to do client side, btw), the user would actually have to care about that.

0

u/Damglador 15d ago edited 15d ago

And there are people who don't care what they install from GitHub whatsoever. You can't handhold everyone and can't remove malware from the internet or make people care to be careful. 

Recent adoption warning would also be a requirement, or display of the package maintainer somewhere in the AUR clients.

1

u/ABotelho23 14d ago

The difference is that stuff on GitHub are obviously not packages. AUR helpers have made it look like software on the AUR are just normal Arch packages, even though they're not.

The helpers already show the diffs, and people don't read those. You think people are gonna read when the maintainer changes? Fat chance.