As an user of the AUR, this is devastating news to me. I am also guilty of accepting updates without reading the latest changes, even if yay asks me if I want to. This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer. And to at least have a look if something suspicious is going in with the recent changes in the package recipe. AND to read in the communities and news.
The fact that the Arch maintainers seem to prefer Reddit over their own fucking news channel is what made me switch from Arch years ago. I got sick of upstream breaking changes fucking my system because they wouldn't notify people through official channels, only to find it later on /r/archlinux 🙄🙄🙄
since the 2022 grub incident, Arch has done a great job at notifying the news channel when "manual intervention required" AFAIK, and I don't remember any instances of Arch maintainers only notifying Reddit (and I don't think they notified Reddit for the grub incident either lol).
Useful list for those who do use Arch; I've only got like two things from AUR and neither is on that list (although I kinda recognize a couple with slightly different names, like what, knock off plugins for official stuff?)
I've seriously gone through manuals in languages foreign to me and still learnt something from it.
My partner doesn't and will only use the basic features of tech. I read the manual, and I'm suddenly a wizard because I got two Bluetooth speakers to pair with each other and get stereo from them.
Reading the manual clearly won't help with the issue here. This is clearly not an appropriate use of RTFM terminology here, because it does not apply. The problem here is not that the user needs to read before asking for help. The problem here is to understand the changes made in the script are malicious. And reading the manual won't help with that.
The false sense of security is actually caused by people saying the AUR is the easiest way to safely get all your packages, when in reality the AUR itself tells you to always review PKGBUILDs and to not blindly trust AUR packages.
There were announcements and security ping in the arch Linux community discord... But I wish they'd be more vocal on this outside discord especially given discords controversy as of late
Update: they finally posted about it in the arch news feed last night... A bit late but better than never. Npm removed the malicious package, but then the bad actors started using bun instead...
As others have proposed, I really think that orphaned packages should require a moderator of the aur to approve the commit and acquisition of an orphaned package. Currently nothing stops someone from spinning up accounts and hijacking these abandoned projects
Or maybe don't use AUR blindly? You're doing the equivalent of sudo curl --- | bash. Who knows what the script is doing. So only do it if you truly trust it. That's why we have warnings plastered all over. That's also why a warning label and sticker exists. And this is precisely the reason easy no user input AUR helpers are greatly discouraged
You said it yourself that it is a community repository. No difference between that and the internet forum. You are putting the burden of accountability on the maintainer that way. Which I would remind you, is unpaid unlike say, github and npm that HAS a financial means to do a lot of security implementation. Yet those platforms still fail to do it.
Also, humans ARE the first layer of defense. Because anything you do on your device (on linux anyway, and specifically arch) is YOUR decision. Antivirus and everything else should kick in when the human fails.
You are normalizing people downloading things off the unvetted internet like on windows. Linux has a vetted repo already. THOSE are what people should be using and I'm fine with if those are being blamed. Everything else is USER due diligence. That is why the existence of easily installing malware like limewire does not justify blaming the platform. Or do you also blame torrenting site when they are chock full of malware?
Sure, your proposed solution is a good way to weed out the low hanging fruit. But I don't like that it may create friction for normal users. AUR was never meant to be a FOSS project on its own with a full time maintainer that maintains PKGBUILD and the infra.
Like I said before, it is more akin to an internet forum and pastebin more than a full fledged package repository. And to be fair, it isn't a package repo anyway. It's like a cmake / makefile sharing site. Building and packaging for arch is just that easy compared to say, debian.
If people want to use a repo, there is chaotic aur. Maybe that could be the way too. A dedicated community project to vet the AUR. Or the project maintainer itself could provide a pkgbuild directly on their repo.
Just don't ever blame the maintainer for providing a place to store something for free and open to anyone. Especially if it is your choice to get something from said place and be surprised that it is malware.
Maybe maintenance of packages shouldn’t just be handed over to newly created accounts. This is a design flaw on AUR’s part.
That is the whole purpose of AUR, users can create and share packages with minimum fuss. That does not mean that it is a good idea to run the code of some random guy on your computer.
But open source has always worked like that, by code sharing and collaboration - on tapes, on FTP servers, on Sourceforge or github and today on codeberg. The way the Arch User Repository (this is AUR spelled out) makes this easy is great!
Just don't run random code that you don't understand, and cannot reasonably trust.
Without the AUR Arch becomes a third world country distro because the official repos have only the basics.
Arch has 17,000 packages and is one of the largest distros. If you want more, you can use Debian, or perhaps Ubuntu if you really need non-free drivers and codecs, (or maybe NixOS, which has a fuckton of packages, but you won't get the same quality).
Whelp...I've REALLY loved EndeavourOS for my laptop, especially because I felt I could mess around with stuff, but maybe this is my call to use something like Fedora or a OpenSUSE variant (I love Tumbleweed dearly).
Nothing against the incredible Arch, but I'm deffos that user who does
> yay
> "Build files exist. Do clean build? N"
> "View changes? N".
ENTER.
I want to learn, but also I'm a bit of a danger to myself if this malware threat is this broad.
Have you heard about the recent fuckups of fedora? fedora is a shitshow.
Oh really? I guess I haven't. 😬
Yeah it was late here so I think I was poorly mushing two separate thoughts together there. I meant I was thinking of moving to a distro that isn't as bleeding-edge for the laptop I'm not updating every single day...But also I should find something that still has a nice large software variety so I stay off AUR.
OpenSUSE has the "Open Build System" which I've used for like one package. So that's pretty neat.
This is really tough because I have two gamers in the family using Nvidia cards I want to help move off of Windows, but I don't want them running into having to roll back as often as I have or fiddle too much, but I feel like Mint is a little too far behind.
So I was considering the KDE spin of Fedora for them...But yeah, the answer isn't so easy anymore lol.
Could you elaborate wrt Fedora being a shitshow? It's my daily driver and I haven't experienced any kind of instability and (to my knowledge) I have not been compromised.
Opensuse is great, been daily driving it for 1.5 years with no issues (issues were solved by booting an old snapshot and rolling back, updating again 2d later)
There's also Slowroll which is Tumbleweed but like 1 week behind in updates for a stable experience, and there's some immutable flavour that I forgot the name of.
I'm using Tumbleweed, the one issue of rolling release (things occasionally breaking) is not an issue since OpenSuse natively supports snapshots (and automatically makes a snapshot before and after every update).
Something breaks? Reboot -> Boot from read-only snapshot -> selecting the one from before the update -> in terminal: snapper rollback -> done. Update again 2d later.
I’m using Tumbleweed, the one issue of rolling release (things occasionally breaking) [...]
My 5 cents is the risk of breaking is overblown in many cases. Of course, you don't want important servers to break. But I am running Debian since 15 years and in fact, for me it broke more often than Arch, for example because of GNOME issues, or NVidia issues. And well that's a biased sample because I use Debian for a larger proportion of time. I think for desktop users, it matters more to have a backup system.
Yes, the only thing that ever breaks for me are my nvidia drivers (specifically if there arent new drivers for a new kernel yet). Sometimes I don't roll back and just keep it, but often I'm using local AI for uni stuff so I roll back to fix them.
How do I check if a system has been affected most easily? As far as I have seen it's related to the npm package atomic-lockfile, so would that be enough?
Maybe someone here can advise. I ran two of the available "checking" scripts to see if I have any packages installed. Both came up with 1 package I have installed. It is gtkimageview, which is on the list.
However, if I look through the pacman.log I see it was installed on 2024-10 and last upgraded 2025-01. It seems to me that suggests I installed it before this all started, so I'm probably not infected?
(hopefully this doesn't read as blaming the victims instead of the attackers but) I personally don't think it's that complicated to read the updates to AUR packages. It's not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?
i wouldnt know where to get the info in the first place. when i use windows update i also dont reed any changelog because that shouldnt be the users job but the suppliers
As an avid user of the AUR, you'd be correct if you were downloading from the official arch repository. But you aren't. AUR is basically like downloading from github. The only "guarantee" you get is from whoever put the package up and its up to you to determine if they're trustworthy.
The whole point of the AUR is that it's just random people's code. There is no supplier here. If you don't know where to find that information, you really shouldn't be using AUR.
that is indeed the official guides' fault if they're not in charge of helping maintain the AUR package. not the case for most of the infected packages here other than notably alvr, though.
Also keep in mind that Arch is (differently from FOSS diehard people like Debian maintainers) quite permissive in what it accepts. This might be comfortable to get some hardware running, but with this you get also stuff like Brave Browser in the software directory which, how do I say this, might not be the best choice for privacy.
So,if you want privacy and safety, you should have a good look at what you install.
Guix on top of Arch, replacing most of AUR packages is also a good alternative (with less involvement of US military companies, more context here, and a nice minimalist configuration language).
Both Nix and Guix can be installed on top of Arch and work as an extra package manager.
Plus Guix is a GNU project and GNU projects are both very open to modification and hacking own stuff, and fairly security-conscious.
It has one fly in the ointment: Guix is really not built for distribution of binary packages of closed-source software (all package definitions build initially from source), and that's why some companies hate it. But for me, this is a plus.
Yes, that's a good alternative. I actually used to do it myself before going full NixOS.
Also I kind of missed the whole Anduril drama. I'll see what it's about. Been a while that I've wanted to try out Guix anyway.
67 Comments
thingsiplay@lemmy.ml · 61 pts · 99d
As an user of the AUR, this is devastating news to me. I am also guilty of accepting updates without reading the latest changes, even if
yayasks me if I want to. This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer. And to at least have a look if something suspicious is going in with the recent changes in the package recipe. AND to read in the communities and news.I don't understand why there still no official announcement as a warning from the Archlinux team at https://archlinux.org/news/ . Is there a different place for security news specifically about the AUR to subscribe to? EDIT: https://archlinux.org/news/active-aur-malicious-packages-incident/ They did it, an official message.
trevor@lemmy.blahaj.zone · 41 pts · 99d
The fact that the Arch maintainers seem to prefer Reddit over their own fucking news channel is what made me switch from Arch years ago. I got sick of upstream breaking changes fucking my system because they wouldn't notify people through official channels, only to find it later on /r/archlinux 🙄🙄🙄
Aatube@kbin.melroy.org · 26 pts · 99d
since the 2022 grub incident, Arch has done a great job at notifying the news channel when "manual intervention required" AFAIK, and I don't remember any instances of Arch maintainers only notifying Reddit (and I don't think they notified Reddit for the grub incident either lol).
muhyb@programming.dev · 5 pts · 99d
It's been 4 years already? WTF?
tanka@lemmy.ml · 4 pts · 99d
What are you using now?
After the end of Win10 I moved to arch but I think my week end will be filled with moving again. ^^
trevor@lemmy.blahaj.zone · 5 pts · 99d
On my desktop, CachyOS 💀
It was years ago when Arch pissed me off, but I couldn't resist Arch-based distros forever. So far, I haven't been burned.
On my laptop, Asahi Linux, which is basically Fedora ARM with a custom kernel. I'd recommend Fedora to most general users.
Aatube@kbin.melroy.org · 2 pts · 99d
ramenu@lemmy.ml · 2 pts · 99d
They made an announcement though
zelifcam@lemmy.world · 2 pts · 99d
Aatube@kbin.melroy.org · 8 pts · 99d
the arch news channel is for breaking changes to arch pacakges (so not the AUR) only. maybe you could subscribe to aur-general@lists.archlinux.org.
thingsiplay@lemmy.ml · 8 pts · 99d
They are actually putting a message on the regular news feed about the AUR! https://archlinux.org/news/active-aur-malicious-packages-incident/ As it should be. It just took a bit too long in my opinion, as discussions are going on since yesterday.
thingsiplay@lemmy.ml · 3 pts · 99d
I was hoping to subscribe with RSS. Not sure how to subscribe there.
Aatube@kbin.melroy.org · 5 pts · 99d
it's a mailing list, so heads up, if you subscribe you're also gonna get other discussion like the forums.
https://lists.archlinux.org/mailman3/lists/aur-general.lists.archlinux.org/
bizdelnick@lemmy.ml · 35 pts · 99d
1579
I don't use Arch BTW.
taiyang@lemmy.world · 10 pts · 99d
Useful list for those who do use Arch; I've only got like two things from AUR and neither is on that list (although I kinda recognize a couple with slightly different names, like what, knock off plugins for official stuff?)
IEatDaFeesh@lemmy.world · 14 pts · 99d
Ahh clearly Arch users didn't RTFM before installing shit. Skill issue.
PS: The above is an invitation to self-care, not an insult.
ohshit604@sh.itjust.works · 17 pts · 99d
I must say, Read The Fucking Manual is a bit more clear than Read The Friendly Manual.
yetAnotherUser@lemmy.ca · 10 pts · 99d
I disagree with the post you put here on a single thing: the manual is sometimes bad, by either not describing everything, or being unclear.
wuphysics87@lemmy.ml · 11 pts · 99d
Is that worse than not reading it at all? Often it is a lead to something more useful
yetAnotherUser@lemmy.ca · 3 pts · 99d
You know what? You're right
Evil_Incarnate@sopuli.xyz · 5 pts · 99d
Best not to read any then, if it might be bad.
I've seriously gone through manuals in languages foreign to me and still learnt something from it.
My partner doesn't and will only use the basic features of tech. I read the manual, and I'm suddenly a wizard because I got two Bluetooth speakers to pair with each other and get stereo from them.
thingsiplay@lemmy.ml · 9 pts · 99d
Reading the manual clearly won't help with the issue here. This is clearly not an appropriate use of RTFM terminology here, because it does not apply. The problem here is not that the user needs to read before asking for help. The problem here is to understand the changes made in the script are malicious. And reading the manual won't help with that.
ShinkanTrain@lemmy.ml · 12 pts · 99d
James@lemmy.ca · 11 pts · 99d
The AUR is basically just a shortcut for downloading random shit off GitHub.
It gives un-experienced users a false sense of security.
HaraldvonBlauzahn@feddit.org · 1 pts · 98d
As is "pip install" by the way.
solxix@pawb.social · 1 pts · 98d
The false sense of security is actually caused by people saying the AUR is the easiest way to safely get all your packages, when in reality the AUR itself tells you to always review PKGBUILDs and to not blindly trust AUR packages.
M33@piefed.world · 10 pts · 99d
Wow that’s bad 🫢
KarnaSubarna@lemmy.ml · 10 pts · 99d
At this point, the count stands at 1500+ https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
starblursd@lemmy.zip · 10 pts · 99d
There were announcements and security ping in the arch Linux community discord... But I wish they'd be more vocal on this outside discord especially given discords controversy as of late
Update: they finally posted about it in the arch news feed last night... A bit late but better than never. Npm removed the malicious package, but then the bad actors started using bun instead...
As others have proposed, I really think that orphaned packages should require a moderator of the aur to approve the commit and acquisition of an orphaned package. Currently nothing stops someone from spinning up accounts and hijacking these abandoned projects
liinux@pawb.social · 3 pts · 99d
Thee's a official Arch Linux D*scord?
starblursd@lemmy.zip · 2 pts · 99d
No it's unofficial but it's I believe the biggest/primary arch Linux community discord .
In their roles chanel you can pick one to get security pings.. major ones are typically also everyone pinged but some have those disabled
floquant@lemmy.dbzer0.com · 7 pts · 99d
You'll pry #archlinux from my cold dead hands
sonofearth@lemmy.world · 9 pts · 99d
davetortoise@reddthat.com · 11 pts · 99d
"No way to prevent this" says only repository where this regularly happens
sonofearth@lemmy.world · 1 pts · 98d
bitfucker@programming.dev · 2 pts · 98d
Or maybe don't use AUR blindly? You're doing the equivalent of
sudo curl --- | bash. Who knows what the script is doing. So only do it if you truly trust it. That's why we have warnings plastered all over. That's also why a warning label and sticker exists. And this is precisely the reason easy no user input AUR helpers are greatly discouragedsonofearth@lemmy.world · 1 pts · 98d
bitfucker@programming.dev · 0 pts · 98d
You said it yourself that it is a community repository. No difference between that and the internet forum. You are putting the burden of accountability on the maintainer that way. Which I would remind you, is unpaid unlike say, github and npm that HAS a financial means to do a lot of security implementation. Yet those platforms still fail to do it.
Also, humans ARE the first layer of defense. Because anything you do on your device (on linux anyway, and specifically arch) is YOUR decision. Antivirus and everything else should kick in when the human fails.
You are normalizing people downloading things off the unvetted internet like on windows. Linux has a vetted repo already. THOSE are what people should be using and I'm fine with if those are being blamed. Everything else is USER due diligence. That is why the existence of easily installing malware like limewire does not justify blaming the platform. Or do you also blame torrenting site when they are chock full of malware?
sonofearth@lemmy.world · 1 pts · 98d
bitfucker@programming.dev · 0 pts · 98d
Sure, your proposed solution is a good way to weed out the low hanging fruit. But I don't like that it may create friction for normal users. AUR was never meant to be a FOSS project on its own with a full time maintainer that maintains PKGBUILD and the infra.
Like I said before, it is more akin to an internet forum and pastebin more than a full fledged package repository. And to be fair, it isn't a package repo anyway. It's like a cmake / makefile sharing site. Building and packaging for arch is just that easy compared to say, debian.
If people want to use a repo, there is chaotic aur. Maybe that could be the way too. A dedicated community project to vet the AUR. Or the project maintainer itself could provide a pkgbuild directly on their repo.
Just don't ever blame the maintainer for providing a place to store something for free and open to anyone. Especially if it is your choice to get something from said place and be surprised that it is malware.
HaraldvonBlauzahn@feddit.org · 0 pts · 98d
That is the whole purpose of AUR, users can create and share packages with minimum fuss. That does not mean that it is a good idea to run the code of some random guy on your computer.
But open source has always worked like that, by code sharing and collaboration - on tapes, on FTP servers, on Sourceforge or github and today on codeberg. The way the Arch User Repository (this is AUR spelled out) makes this easy is great!
Just don't run random code that you don't understand, and cannot reasonably trust.
sonofearth@lemmy.world · 0 pts · 98d
HaraldvonBlauzahn@feddit.org · 0 pts · 98d
The Arch team is not responsible for this code.
And to add, demanding to do more work from volunteers which already do a lot of work for free is rude. If you want something done - do it yourself.
sonofearth@lemmy.world · 0 pts · 98d
HaraldvonBlauzahn@feddit.org · 0 pts · 98d
Not from AUR.
sonofearth@lemmy.world · 1 pts · 98d
HaraldvonBlauzahn@feddit.org · 0 pts · 98d
Arch has 17,000 packages and is one of the largest distros. If you want more, you can use Debian, or perhaps Ubuntu if you really need non-free drivers and codecs, (or maybe NixOS, which has a fuckton of packages, but you won't get the same quality).
And what do you need so many packages for?
sonofearth@lemmy.world · 1 pts · 98d
MonkeMischief@lemmy.today · 8 pts · 99d
Whelp...I've REALLY loved EndeavourOS for my laptop, especially because I felt I could mess around with stuff, but maybe this is my call to use something like Fedora or a OpenSUSE variant (I love Tumbleweed dearly).
Nothing against the incredible Arch, but I'm deffos that user who does
ENTER.
I want to learn, but also I'm a bit of a danger to myself if this malware threat is this broad.
somegeek@programming.dev · 4 pts · 99d
Have you heard about the recent fuckups of fedora? fedora is a shitshow.
If you just yolo with yay anyway, you will get compromised on any system you use, ni matter the OS or distro, my dude.
MonkeMischief@lemmy.today · 5 pts · 99d
Oh really? I guess I haven't. 😬
Yeah it was late here so I think I was poorly mushing two separate thoughts together there. I meant I was thinking of moving to a distro that isn't as bleeding-edge for the laptop I'm not updating every single day...But also I should find something that still has a nice large software variety so I stay off AUR.
OpenSUSE has the "Open Build System" which I've used for like one package. So that's pretty neat.
This is really tough because I have two gamers in the family using Nvidia cards I want to help move off of Windows, but I don't want them running into having to roll back as often as I have or fiddle too much, but I feel like Mint is a little too far behind.
So I was considering the KDE spin of Fedora for them...But yeah, the answer isn't so easy anymore lol.
DisasterTransport@startrek.website · 3 pts · 98d
Could you elaborate wrt Fedora being a shitshow? It's my daily driver and I haven't experienced any kind of instability and (to my knowledge) I have not been compromised.
kuerbiskernoel@feddit.org · 4 pts · 99d
Opensuse is great, been daily driving it for 1.5 years with no issues (issues were solved by booting an old snapshot and rolling back, updating again 2d later)
HaraldvonBlauzahn@feddit.org · 2 pts · 98d
OpenSuSE also comes in two flavours, Leap (a stable release) and Tumbleweed (which is rolling release and sligthly less bleeding edge than Arch).
You can even run Opensuse stable, and in a VM on top Tumbleweed to have a system where you can safely try out new stuff.
kuerbiskernoel@feddit.org · 2 pts · 98d
There's also Slowroll which is Tumbleweed but like 1 week behind in updates for a stable experience, and there's some immutable flavour that I forgot the name of.
I'm using Tumbleweed, the one issue of rolling release (things occasionally breaking) is not an issue since OpenSuse natively supports snapshots (and automatically makes a snapshot before and after every update).
Something breaks? Reboot -> Boot from read-only snapshot -> selecting the one from before the update -> in terminal: snapper rollback -> done. Update again 2d later.
HaraldvonBlauzahn@feddit.org · 2 pts · 98d
My 5 cents is the risk of breaking is overblown in many cases. Of course, you don't want important servers to break. But I am running Debian since 15 years and in fact, for me it broke more often than Arch, for example because of GNOME issues, or NVidia issues. And well that's a biased sample because I use Debian for a larger proportion of time. I think for desktop users, it matters more to have a backup system.
kuerbiskernoel@feddit.org · 1 pts · 98d
Yes, the only thing that ever breaks for me are my nvidia drivers (specifically if there arent new drivers for a new kernel yet). Sometimes I don't roll back and just keep it, but often I'm using local AI for uni stuff so I roll back to fix them.
HaraldvonBlauzahn@feddit.org · 2 pts · 98d
I solved that one by buying an AMD radeon card. Zero fuss since then.
demizerone@lemmy.world · 4 pts · 99d
I learned 10 years ago not to use aur helpers because they hide the sources. Aurutils + vifm baby!
helix@feddit.org · 4 pts · 99d
How do I check if a system has been affected most easily? As far as I have seen it's related to the npm package atomic-lockfile, so would that be enough?
zipkag@lemmy.world · 3 pts · 98d
Maybe someone here can advise. I ran two of the available "checking" scripts to see if I have any packages installed. Both came up with 1 package I have installed. It is gtkimageview, which is on the list.
However, if I look through the pacman.log I see it was installed on 2024-10 and last upgraded 2025-01. It seems to me that suggests I installed it before this all started, so I'm probably not infected?
SocialistVibes01@lemmy.ml · 2 pts · 99d
(btw)
Aatube@kbin.melroy.org · 2 pts · 99d
(hopefully this doesn't read as blaming the victims instead of the attackers but) I personally don't think it's that complicated to read the updates to AUR packages. It's not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?
istdaslol@feddit.org · 1 pts · 99d
i wouldnt know where to get the info in the first place. when i use windows update i also dont reed any changelog because that shouldnt be the users job but the suppliers
Vendetta9076@sh.itjust.works · 7 pts · 99d
As an avid user of the AUR, you'd be correct if you were downloading from the official arch repository. But you aren't. AUR is basically like downloading from github. The only "guarantee" you get is from whoever put the package up and its up to you to determine if they're trustworthy.
Ghoelian@piefed.social · 6 pts · 99d
The whole point of the AUR is that it's just random people's code. There is no supplier here. If you don't know where to find that information, you really shouldn't be using AUR.
istdaslol@feddit.org · 2 pts · 99d
In an ideal world yes, but I needed some software that was only available via AUR and if the official guides tell me I can install it via AUR I will.
Aatube@kbin.melroy.org · 1 pts · 98d
that is indeed the official guides' fault if they're not in charge of helping maintain the AUR package. not the case for most of the infected packages here other than notably alvr, though.
Aatube@kbin.melroy.org · 1 pts · 98d
windows update doesn't force you to take a look at the changelog. most AUR helpers do so you better bet that it's important
whatiswrongwithyou@lemmy.ml · 2 pts · 99d
Dang, if only their packages were more up to date maybe this wouldn’t have happened.
HaraldvonBlauzahn@feddit.org · 1 pts · 98d
Also keep in mind that Arch is (differently from FOSS diehard people like Debian maintainers) quite permissive in what it accepts. This might be comfortable to get some hardware running, but with this you get also stuff like Brave Browser in the software directory which, how do I say this, might not be the best choice for privacy.
So,if you want privacy and safety, you should have a good look at what you install.
bitfucker@programming.dev · 3 pts · 98d
AUR is not Arch maintainer vetted repo tho. Even librewolf is not in the arch repo.
The closest equivalent of AUR is PPA/launchpad
HaraldvonBlauzahn@feddit.org · 1 pts · 98d
Oh, of course. I didn't repeat that, because this is is clearly stated in the docs and should be well known now.
myszka@lemmy.ml · 1 pts · 98d
This is why I use NixOS
HaraldvonBlauzahn@feddit.org · 2 pts · 98d
Guix on top of Arch, replacing most of AUR packages is also a good alternative (with less involvement of US military companies, more context here, and a nice minimalist configuration language).
Both Nix and Guix can be installed on top of Arch and work as an extra package manager.
Plus Guix is a GNU project and GNU projects are both very open to modification and hacking own stuff, and fairly security-conscious.
It has one fly in the ointment: Guix is really not built for distribution of binary packages of closed-source software (all package definitions build initially from source), and that's why some companies hate it. But for me, this is a plus.
myszka@lemmy.ml · 1 pts · 96d
Yes, that's a good alternative. I actually used to do it myself before going full NixOS. Also I kind of missed the whole Anduril drama. I'll see what it's about. Been a while that I've wanted to try out Guix anyway.
veniasilente@lemmy.dbzer0.com · 1 pts · 99d
Play stupid games win stupid prizes I guess.