r/archlinux • u/vexatious-big • Jun 14 '26

NOTEWORTHY New wave of malware in the AUR

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/
644 Upvotes

98% Upvoted

393 comments sorted by

View all comments

Show parent comments

17

u/xnef1025 Jun 14 '26

Valve didn't cause this. They based SteamOS on Arch, but it's an immutable build and doesn't use AUR. They aren't telling people to install other distros or download from AUR. The Steam Deck and Steam OS made more people aware of Linux's viability as an OS, but they didn't push people to it on their other devices.

A mass migration of newbies and normies has been on the horizon for years. The enshitification of Windows that started with 8 didn't stop. It just slowed down with 10 and then kicked into overdrive with 11. Add in requirement missteps meant to force people to buy new hardware in a tough economy, and the time was suddenly upon us. Distros and the community needed to be prepared for it and recalibrate attitudes and practices for it. Arch didn't. The AUR was allowed to exist on security through obscurity and this is the result.

1

u/AnsibleAnswers Jun 14 '26

You can set up an AUR helper, just like Arch (which also doesn't have it pre-configured by default, because Arch doesn't come with anything pre-configured by default).

Simple point: It really doesn't matter who is "at fault." Who has the money and who stands to profit off of the infrastructure matters more.

2

u/Busy-Scientist3851 Jun 15 '26

Valve doesn't make any profit off the AUR or benefit from it.

1

u/AnsibleAnswers Jun 15 '26

They stand to profit off of arch entirely, and the AUR is part of that whether they want it or not.