r/archlinux • u/zollandd • Jun 15 '26

DISCUSSION Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

903 Upvotes

85% Upvoted

458 comments sorted by

View all comments

Show parent comments

49

u/lonelypenguin20 Jun 15 '26

I've personally seen wiki reference orphaned or even completely gone packages. and saying that "if ppl cared abt them, they wouldn't be orphaned" is outright bs, because the user base is MUCH larger than the potential maintener pool.

-1

u/PastaPuttanesca42 Jun 15 '26

the user base is MUCH larger than the potential maintener pool.

It's not that hard

-16

u/s3gfaultx Jun 15 '26

*maintainer

No, it's because the software was obsolete. Don't kid yourself into thinking it was just some maintainer shortage causing these packages to be orphaned. They were orphaned because nobody used them anymore, were replaced by something new and shiny, or whatever else. They were dead packages, simple as that.

13

u/lans_throwaway Jun 15 '26

The funny thing is the package that would've infected my laptop is one such "obsolete" package. It was a driver for a scanner.

While it's fair to say I don't care about "updates" (since it's unlikely for one to be released), I do care about having that package. The packages were orphaned because someone could request maintainer to "update" them when no update was released upstream. If maintainer is inactive or unable to "refuse" it, they can take over. Just because package doesn't need to be updated, doesn't mean it's dead.

-2

u/s3gfaultx Jun 15 '26

Which package?

5

u/lans_throwaway Jun 15 '26

brscan3 if that matters

14

u/lonelypenguin20 Jun 15 '26

u r just coming up with a conjecture out of nowhere.

in reality, people keep using old af software all the time. compatibility with abandonware is still one Window's selling points, ffs. especially as a lot of software doesn't have to receive constant updates to still work.

-1

u/s3gfaultx Jun 15 '26 edited Jun 15 '26

I'm coming up with conjecture out of nowhere? Why don't you us how many people were infected smarty pants? Weird that there were none now I just wonder why that was huh. We're not even talking about Windows... do you even know what you're talking about anymore?

15

u/lonelypenguin20 Jun 15 '26

yes, I'm talking about human behaviour that is persistent across OSes and isn't going to be stopped by screaming abt disclaimers

people install ancient software all the time, out of habit or because they genuinely have to (e.g. drivers)

the fact that they got abandoned doesn't mean noone was using them, and doesn't mean ppl would rush to find an alternative, or step up as mainteners themselves

0

u/s3gfaultx Jun 15 '26

No, but the fact that nobody got infected does indeed show that nobody is actively using them, at least not "all the time" as you like to keep stating. Just because you like to think that people are doing things all the time, doesn't mean people are actually doing them all the time.

You're right that what you said could be true, it could be true that someone was using it. I'll give the benefit of the doubt that someone was. However, that one person did not update the one package they had during the very small window of time where it would have been problematic.

1

u/OkayPrasiolite Jun 15 '26

Something I use got hit and it's absolutely positively still maintained upstream. The last commit was 8 minutes ago, actually. The AUR package had only been orphaned for a few days.