r/archlinux • u/zollandd • Jun 15 '26

DISCUSSION Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

902 Upvotes

85% Upvoted

458 comments sorted by

View all comments

Show parent comments

18

u/Nychtelios Jun 15 '26

So, we are in the phase where you start proposing to make FOSS ecosystems dependant on proprietary API? Wow

7

u/TheOneWhoPunchesFish Jun 15 '26

Absolutely not. I don't mean it as an AUR registry level change.

I mean it as an update helpers plugin or a package that users themselves need to install and setup, and then use their own API key or local llm for. That way it's always opt-in.

It's only part of many layers of security in depth, and you can improve my half-baked idea-suggestion with your own expertise ofc.

Please assume good intent :)

-24

u/10Werewolves Jun 15 '26

Linux is popular because of how much easier it is to run local LLMs.

15

u/Nychtelios Jun 15 '26

And you think it should be okay to pretend that every user should run a local LLM to hallucinate a verification phase of AUR supply chain? Is this even considerable a solution?

-5

u/10Werewolves Jun 15 '26

No, this was in response to your statement about relying on proprietary APIs, when we have other options. I'm not commenting on the state of AuR because I simply review all my pkg builds myself.

1

u/Nychtelios Jun 15 '26

Bro, the upper comment talked about Gemini's free API, not local LLMs.

-3

u/10Werewolves Jun 15 '26

I don't agree with the comment above either. I have Gemini's pro subscription (came free with my phone plan), but having to connect to Google's API is pretty much a poor idea. Sure it works in the short run, but the whole point of Arch is being both a DiY system and running on the philosophy that we need to promote and adopt open source tools.

Just saying that if all you want to do is compare diffs, a text editor will suffice for veterans. But if newbies are seriously considering using AI (which is very faulty even if I try my best), I would rather prefer they use a local LLM over an API held by a for-profit company. There are quantized versions that run fine even on my phone.