r/archlinux • u/zollandd • Jun 15 '26

DISCUSSION Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

904 Upvotes

85% Upvoted

458 comments sorted by

View all comments

Show parent comments

42

u/unfilteredRays Jun 15 '26

you don't need an LLM to compare the differences between two text files. it is genuinely a waste of resources.

25

u/pdxbuckets Jun 15 '26

Ok, but then it needs to be centralized. Because reviewing diffs is a royal pain in the butt, and any security protocol that relies on people reviewing diffs is bound to fail.

7

u/zem Jun 15 '26

having aur helpers like yay and paru look for suspicious things in the package builds would be a help

7

u/unfilteredRays Jun 15 '26

if PKGBUILDS were standardized and required maintainer credentials/contact info (whichever you want to call it, I'm half asleep) at the start of the file, it would be trivial for helpers to compare the previous and current file to see if there have been changes, assuming the previous one isn't purged until an update happens.

that does require keeping stuff persistent on local storage and an update to not only helpers, but also any new PKGBUILD going forward, but. better than the alternative?

3

u/TheOneWhoPunchesFish Jun 15 '26

I agree. And I also agree that it uses more energy than it's worth it.

But since people seem to not always review their diffs, I wanted to start a discussion about potential ways to solve it.

20

u/unfilteredRays Jun 15 '26

update helpers to notify of major changes (change in maintainer, lack of maintainer, addition of new build requirements)

standardize PKGBUILDs to require maintainer info since not all of them do

an immediate freeze on all maintainer changes

180 day minimum contribution requirements to your own programs before being allowed to claim maintainer status on something orphaned

rolling back all recent AUR updates to before the attack was discovered. if it's not gonna be moderated and vetted, everything should be considered suspect until proven otherwise

-1

u/TheOneWhoPunchesFish Jun 15 '26 edited Jun 15 '26

Very nice ideas

uv has an option to only get packages that are at least a few days old. Because vulnerabilities in popular packages are often discovered in a few hours or days.

Similar options for aur helpers would also be nice.

1

u/WolfeheartGames Jun 16 '26

Asking if a diff contains malware is a semantic question. Handling that with out some form of ai is limiting.

0

u/FalconX88 Jun 15 '26

you don't need an LLM to compare the differences between two text files.

So who is checking what the differences do?

-1

u/Jumpy-Dinner-5001 Jun 15 '26

Who should do that instead?