Why does anything need to change? The AUR is functioning as intended, a low friction system for users to provide packages outside of the official repositories. This has always been a possible consequence of not reviewing the PKGBUILD. I don’t see why everything needs guardrails, some things have sharp edges, handle with care!
Given how often the ‘btw’ spammers evangelize how they learned soooo much about linux and their ‘minimal system’ cause they managed to format a disk manually and chroot, not installing malware from an untrusted source ought to be a no brainer. Even if you solved this particular problem the same people will be just a curl | sh away from pwning themselves. Should we start requiring forced auth to pipe?
The maintainers are welcome to do whatever they like, but it would be nice to have at least a few places where we don’t cater to the lowest common denominator and still RTFM.
Just the case of the packages being removed only a few hours after been published just makes my point of “trusted users” reviewing and reporting then.
And is not only an archlinux/AUR problem, the same happens with python pip, npm, dockerhub, github…
With bigger popularity, bigger the target.
These days after the success of Steamdeck many users switched to Linux, and many of those started using arch or based distros like EndeavourOS because some one on reddit, YouTube or other said is the best for new hardware and you can find everything you need on AUR.
New users won’t review scripts or PKGBUILD, that’s gibberish, just search and install, and a few hours could be too late for some.
I don’t care if Linux loses or gains popularity, but if there’s no guard rails of some kind of control things could get worse, and even end AUR as it is now.
Having people control what’s published or not, probably not the best solution, but leaving it as a wild west also not
Why does anything need to change? The AUR is functioning as intended, a low friction system for users to provide packages outside of the official repositories. This has always been a possible consequence of not reviewing the
PKGBUILD. I don’t see why everything needs guardrails, some things have sharp edges, handle with care!Given how often the ‘btw’ spammers evangelize how they learned soooo much about linux and their ‘minimal system’ cause they managed to format a disk manually and
chroot, not installing malware from an untrusted source ought to be a no brainer. Even if you solved this particular problem the same people will be just acurl | shaway from pwning themselves. Should we start requiring forced auth to pipe?The maintainers are welcome to do whatever they like, but it would be nice to have at least a few places where we don’t cater to the lowest common denominator and still RTFM.
Just the case of the packages being removed only a few hours after been published just makes my point of “trusted users” reviewing and reporting then.
And is not only an archlinux/AUR problem, the same happens with python pip, npm, dockerhub, github… With bigger popularity, bigger the target.
These days after the success of Steamdeck many users switched to Linux, and many of those started using arch or based distros like EndeavourOS because some one on reddit, YouTube or other said is the best for new hardware and you can find everything you need on AUR.
New users won’t review scripts or PKGBUILD, that’s gibberish, just search and install, and a few hours could be too late for some.
I don’t care if Linux loses or gains popularity, but if there’s no guard rails of some kind of control things could get worse, and even end AUR as it is now.
Having people control what’s published or not, probably not the best solution, but leaving it as a wild west also not