voytrekk 18 points 4 months ago

I think this shows that the process of changing ownership of an orphaned package needs to be a manual process.

Of course, AUR packages also need to be thoroughly vetted by the end users to avoid unexpected changes.

path: 0 24259982, hotness: undefined, score: 18, children: 0

dadarobot 14 points 4 months ago

this is awful. the aur is my favorite feature of arch based distros.

save

path: 0 24256571, hotness: undefined, score: 14, children: 2

wuphysics87 4 points 4 months ago

Really? Not pacman?

save

path: 0 24256571 24277247, hotness: undefined, score: 4, children: 1

dadarobot 1 point 4 months ago

most distro package managers strike me as about the same. having a massive library of obscure stuff packed up to work on my system was a big plus. disnt have to compile hardly anything from source anymore

save

path: 0 24256571 24277247 24280696, hotness: undefined, score: 1, children: 0

starshipwinepineapple 12 points 4 months ago

So you remember how your helper asks you to see diffs ... you take a look at those and understand them before approving, right?

Because I'm getting the sense that people are not doing that

save

path: 0 24261592, hotness: undefined, score: 12, children: 7

KyuubiNoKitsune 2 points 4 months ago

And if you're not a developer?

save

path: 0 24261592 24263193, hotness: undefined, score: 2, children: 6

bitfucker 7 points 4 months ago

Then don't use an automatic AUR helper. Use chaotic aur if you must. Or use aurto

save

path: 0 24261592 24263193 24270373, hotness: undefined, score: 7, children: 0

starshipwinepineapple 3 points 4 months ago

Then learn to read the diffs. Most of the time they are changing the version number and package hash which is mundane and nothing to worry about. If more than that changed then that should make you curious why and dig deeper.

save

path: 0 24261592 24263193 24265754, hotness: undefined, score: 3, children: 2

KyuubiNoKitsune 2 points 4 months ago

I know how, I'm just saying, not everyone has the technical acumen.

save

path: 0 24261592 24263193 24265754 24268923, hotness: undefined, score: 2, children: 1

starshipwinepineapple 1 point 4 months ago

Right, and I'm saying that a lot of updates are mundane and easy for anyone to read. And if they aren't mundane then look into it. Try to learn. The alternative is to run code you don't understand and hope for the best which didn't work out for people here. So if you don't want to try to learn, and you don't want to blind trust, then the alternative is to not use the AUR.

Like one of the attack vectors was adding a "post install" step that was a bunch of obsfucated gibberish which should've been a red flag for anyone, technical acumen or not

save

path: 0 24261592 24263193 24265754 24268923 24271165, hotness: undefined, score: 1, children: 0

Attacker94 2 points 4 months ago

Even if you aren't a dev, any user that chooses to use the aur should do their due diligence. There is a reason why I prefer flatpacks over aur, I don't want to have to check diff's every update.

save

path: 0 24261592 24263193 24263488, hotness: undefined, score: 2, children: 0

Thorned_Rose 1 point 4 months ago

You don't need to be a developer to read diffs and package builds. I have memory and cognitive impairment and manage fine. I'm also not remotely into software programming.

save

path: 0 24261592 24263193 24264689, hotness: undefined, score: 1, children: 0

YiddishMcSquidish 3 points 4 months ago

I wonder if this is because of steamOS switching to Arch, and they have a wider target now.

save

path: 0 24271446, hotness: undefined, score: 3, children: 2

deathmetal27 3 points 4 months ago

Steam OS is immutable and does not enable AUR use by default.

Unless you're a power user you probably won't be using AUR on Steam OS.

save

path: 0 24271446 24281341, hotness: undefined, score: 3, children: 0

HaraldvonBlauzahn 1 point 4 months ago

Another thing is perhaps GenZ does not grok PC security. Security-wise, a Linux PC is very different from an iPhone, because everything shares the home folder.

save

path: 0 24271446 24274319, hotness: undefined, score: 1, children: 0