188
Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted (www.phoronix.com)
submitted 1 week ago by to c/linux@lemmy.ml
66 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 12 points 1 week ago* (last edited 1 week ago) (5 children)

I use malware, btw 😎

Arch should be stopped to be recommended to new users of Linux ASAP

  • permalink
  • fedilink
  • source
  • hideshow 10 child comments
    •
  • [–] 8 points 1 week ago (2 children)

    Is anybody really recommending Arch to new users though?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 10 points 1 week ago (2 children)

    Yeah, there's a ton of people that recommend Cachy when it is really meant for tinkerers IMHO

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    I'm very tired of the rhetoric that Arch is only meant for tinkerers. If all you do is have plasma steam and a web browser it's no more or less likely to break than any other distro. You could go your entire life without ever looking at the terminal.

    And while yes this malware is a problem it is specifically in the aur, the arch user repository an unofficial repository not officially supported, just don't use it. Unless you need a weird piece of software generally related to some type of specific hobby you're unlikely to ever even want to look at it anyway.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    I do agree with this in theory. I just don't know many 'normal people' that are going to only ever require those three things. (Totally with you on the AUR bit)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago

    Really? If anything I have the opposite problem all the normal people I'm aware of probably don't even need steam just the web browser and plasma. Pretty much everything is in the web browser these days I mean they might want the dedicated discord client but that's ultimately just a web browser in a box and will also work perfectly no AUR required

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 week ago (2 children)

    Arch as far as I am aware has never been recommended to new users. Sure their is CachyOS and other variants. And on top of that AUR you shut read the build scripts. But I suppose not many people do that unfortunately.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 week ago

    more importantly, they don't recommend that users use the AUR repository (that isn't to say they are opposed to it). Some advice they have given is to review what the dependencies are before executing the package with an AUR helper or manually.

    Just to make a point, there is a surplus of these non officially supported (from OS developers) repositories, such as the terra repository for fedora. It has the same vulnerability as AUR, and yet that is targeted for new users.

    Much like how fedora doesn't officially support Terra, arch doesn't support AUR. There is a reason why it's called AUR (arch user repository) over ASR (arch supported repository). AUR entails that it is not supported by arch.

  • permalink
  • fedilink
  • source
  • parent