Just be aware that the AUR is not vetted. Its like downloading random stuff of the internet and then install said stuff. Always check your sources.
I was thinking that too, like downloading random .exes and complaining your Windows got a virus. At least now a days, Windows .exes have a signing process that warn you, but that’s just like using non-AUR sources; they’re verified.
But we like Linux because it doesn’t give you a big scary full screen warning every time you try to open something… so IDK. If that’s what you need to keep you from installing malware, get off Arch.
That’s not why I like Linux… but on that note anyway: if the source providing said warning is trustworthy, then let’s have it!
I know everyone say “use at your own risk,” but in practice that’s not how regular users are using npm, PyPi, AUR, Cargo and such. They’re not manually reviewing every little update to a deluge of dependencies.
…I’m guilty of this.
I don’t know a perfect solution, but it feels like this can’t go on, as package hijacking is en vogue now.
Containerization to contain damage is good, I guess, but still.
I know everyone say “use at your own risk,” but in practice that’s not how regular users are using npm, PyPi, AUR, Cargo and such.
This won’t work any more in the future. Linux is too big and the Internet, or the world as a whole has become an too unfriendly place.
It is like that I once lived in a small village in Belgium in a shared house and I loved that we never needed to lock the door, even when we were away. But you can’t do that in a big city.
Well, as a Linux user, you can’t run untrusted code from strangers. Which is what AUR and PyPy is. As a normal user, you should run only checked code from your distribution. And when you develop software, you need to check the credentials and signatures of upstream software and their developers.
Good luck with checking all dependencies as a developer, bonus points for JavaScript. You’ve just become a 98% less effective. But seriously, how would you check everything? And if you stumble upon malicious code, would you even recognize it?
I use malware, BTW.
I’d love to know what’s going on with this. Arch has its haters but someone’s putting a lot of effort into this
The article mentions the potential need for human review. I have no idea how that could be feasible for something as massive as the AUR. Maybe it could work like Nix, where every package goes through a PR/MR process, and then after it gets approved, the submitter is added to the list of contributors. It’s definitely not a perfect process, but it’s better than the zero-review process that the AUR has.
I’ve noticed some installers have at least a voting system (e.g. Octopi) which helps… slightly. At least in knowing what the right package name probably is. Crowd source reviewing is probably the only option for such a vast and open system, even if it can be gamed sometimes.
imo, there should be automatic tags like “active”, “abandoned”, “maintainer changed recently”, “updated after hiatus” and a few more.
The arch devs and community can decide on the time frames. It’s not going to be perfect, but it may help warn users of the changes and so they can do a double take.
Anything other than the “active” ones should show what changed (paru already does this) and users should make a conscious choice to install it anyway. (y/N) instead of going through the installation spamming the return key.
