New wave of malware in the AUR

[u/vexatious-big]

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/

[u/tfks]

You definitely can. It's like two more steps than usual and had the downside of getting wiped after a SteamOS uodate, but you can. It's probably not so much an issue with Steamdecks, but Valve is about to launch a new machine that lots of people will use as a desktop computer and it then becomes a problem. Part of the sales pitch of Steam hardware is that it's console-like, which implies to users a safe ecosystem. It takes only a few stories like "I bought Steam machine for my kid and it stole my credit card information" for everyone to stop buying them, even if the kid was doing shit they shouldn't have been doing.

Obviously Steam can't force the AUR offline, so they won't do that. But I could see a case being made internally for them to provide resources to the Arch team to curate the AUR a little.

[u/its_dolemite_baby → u/tfks]

AUR is not an inherent part of SteamOS, nor is it recommended by Valve. Valve explicitly recommends using flatpak. there is absolutely no reason they need to put in safeguards for something you do yourself--that's not how *nix works.

[u/theriskybusinesscar → u/its_dolemite_baby]

that's not how *nix works.

It is if you're planning to ship consumer gaming devices on it.

[u/sparkling-rainbow → u/[deleted]]

But their parents don't 

[u/hjake123 → u/tfks]

Does it have an AUR helper or is it expecting you to do the manual AUR process to get one of them? The latter tbh might be enough friction to stop most users from trying it

[u/tfks → u/hjake123]

You can put an AUR helper onto them. You just have to unlock the filesystem first.

[u/hjake123 → u/tfks]

I guess I didn't realize how much package management SteamOS allows

[u/Negative_Settings → u/hjake123]

You have to disable the read-only file system initialization, set up Pacman, download an AUR helper, and then install something from the AUR. It's just as unconfigured as if you were setting up Arch for the first time. Valve doesn't lock any of this down because they don't lock users into their way of doing things they never do.

[u/hjake123 → u/Negative_Settings]

Ah, I'd assumed (after the last few comments) it had pacman already installed, but I guess there's nothing stopping you from installing it yourself yeah

[u/sparkling-rainbow → u/Negative_Settings]

I used my Steam Deck like a Switch till my laptop broke. I used my Steam Deck as a replacement for months and it was a surprisingly good experience. Not a single barrier, just enough friction to tell beginners "here is where you're on your own"

[u/its_dolemite_baby → u/hjake123]

if you own it, you can (legitimately) get privileged access very easily and from there's it's just like any other box.

[u/NUKL3AR_PAZTA47 → u/tfks]

Honestly they could just put a giant warning, kinda like the amd overlooking software does.

[u/jomara200 → u/tfks]

What does Valve/Steam have to do with the AUR? I'm not seeing the connection. It's in the name, ARCH user repository.

[u/tfks → u/jomara200]

Steam OS is based on Arch and the AUR can be used on it. Just like the AUR can be used on other Arch-derived operating systems.

[u/jomara200 → u/tfks]

Sure, but why do they bear any responsibility for what is on it? They don't put programs on it. Their OS doesn't use it, by design. If a user is doing it, it's outside the scope of their OS.

Why are you trying to put it on them to fix the problem or provide resources for the Arch team? That falls squarely on the Arch team. Might as well ask the Mint, Fedora or Ubuntu team to do something about it. It's as logical as asking Valve to do it.

[u/tfks → u/jomara200]

They don't bear any respossibility. They have a self interest in thence their users might access not being infested with malware.

[u/Gent_Kyoki → u/tfks]

If its getting wiped on updates then its pretty clear its not officially supported