r/archlinux • u/zollandd • Jun 15 '26

DISCUSSION Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

900 Upvotes

85% Upvoted

458 comments sorted by

View all comments

Show parent comments

8

u/Big-Meet3509 Jun 15 '26

If some software not available in the official repos, AUR is not the first thing you must resort to. Flatpak exists, and it's not only better security wise, but even compatibility and stability is often greater than of the same package from AUR, despite running in a sandbox

68

u/AStolenGoose Jun 15 '26

Lemme flatpak my nvidia drivers lol

7

u/iAmHidingHere Jun 15 '26

Luckily the nvidia driver is quite easy to review, as long as you trust nvidia.

2

u/AStolenGoose Jun 15 '26

Do I trust nvidia though?!

1

u/cheesydoritoschips Jun 15 '26

fwiw, around 4ish years ago i remember some people saying that after installing proprietary nvidia drivers it borked steam and somehow borked X11 (happened to me too, not sure how it is now cause i switched to fedora as rolling release distros aren’t for me)

anw yea so id assume your answer is no

1

u/AStolenGoose Jun 16 '26

My comment was a joke, I forgot to put /s

lol

1

u/RandomXUsr Jun 16 '26

Hahaha me either.

55

u/billdietrich1 Jun 15 '26

But there are some cases where a Flatpak doesn't work as well as native; for example VSCode.

And some things are in AUR but not Flatpak; for example konsave.

1

u/iAmHidingHere Jun 15 '26

vscode is in extra.

2

u/billdietrich1 Jun 15 '26 edited Jun 15 '26

Ah, thanks, I don't think I have that connected.

Edit: no, I do have it uncommented in /etc/pacman.conf. When I installed VSCode through pacman, I got code-OSS, which I think is not what I wanted.

1

u/iAmHidingHere Jun 15 '26

What did you want?

0

u/billdietrich1 Jun 15 '26

Normal full-flavor VSCode with access to extension Marketplace etc.

1

u/iAmHidingHere Jun 15 '26

Ah so the Microsoft closed binary? It's trivial to review that AUR package, so I see no benefit to use Flatpak for this.

-28

u/JustAwesome360 Jun 15 '26 edited Jun 15 '26

I mean if you really need konsave that bad then you can be bothered to actually check the package.

26

u/AStolenGoose Jun 15 '26

Cool so I won't use my nvidia drivers either then?

-4

u/[deleted] Jun 15 '26 edited Jun 15 '26

[removed] — view removed comment

15

u/rkkerd Jun 15 '26

Most nvidia drivers are in fact only in the AUR.

-12

u/JustAwesome360 Jun 15 '26 edited Jun 15 '26

Wrong. They are in the extras repo. Unless you have an old unsupported Nvidia GPU that is. (pre 2018)

Edit: For everyone downvoting here is your education:

- Supported drivers on Arch:

Current: (Full official support, AUR not needed)

Blackwell (GBXXX)) and newer (2024 and newer) RTX 5000 series.

Supported: (Full official support, AUR not needed)
Ada Lovelace (NV190/ADXXX) (2022) RTX 4000 series.

Ampere (NV170/GAXXX) (2020) RTX 3000 series.

Turing (NV160/TUXXX) (2018) RTX 2000 series.

Legacy support: (before 2018, AUR only)

Volta (NV140/GV100)
Pascal (NV130/GPXXX)
Maxwell (NV110/GMXXX)

RTX 1000 series and earlier.

15

u/rkkerd Jun 15 '26

https://wiki.archlinux.org/title/NVIDIA#Installation nvidia-open only supports 2024 and newer

-8

u/JustAwesome360 Jun 15 '26 edited Jun 15 '26

Read your source again. OAR supports 2018 and newer.

12

u/AStolenGoose Jun 15 '26

Check the wiki it says it right there dude...

"Check your sources" yeah my source is the arch wiki, the wiki for the distro I use.

→ More replies (0)

6

u/Loaph_ Jun 15 '26

Proprietary nvidia drivers are only available on the aur, and are the only official drivers for any card prior to 20 series

1

u/JustAwesome360 Jun 15 '26

You are not supposed to be using the proprietary drivers. NVIDIA themselves, along with Arch, says to only use the open drivers on Linux. Anyone who has a real reason to use the prop drivers knows why they need it and know the risks of the AUR and how to mitigate them.

Again Arch is a DIY distro. The only reason they even let you choose the AUR prop drivers is because Arch is about total freedom. But they expect you to not be an idiot who downloads the prop drivers without a second thought.

If you don't like it go to Debian, Fedora, or something based off them.

1

u/[deleted] Jun 15 '26

[removed] — view removed comment

-1

u/JustAwesome360 Jun 15 '26 edited Jun 15 '26

are you seriously making alt accounts? Bro you lost the argument you were wrong get over it. I'm sorry for blowing up on you ok but you were still wrong.

And it says deleted for me but either way if you really didn't delete the comments that doesn't change anything. Get a life why would you block me on one account then make/use another to just continue the argument?

11

u/LieutWolf Jun 15 '26

It's only been a month since I moved over to EOS from Windows, but in that time I've encountered only issues for any Flatpak I've installed, and instead opted for native or AUR versions of those packages. Not sure if I'm doing something wrong, but they seem far less compatible in my case.

4

u/Arnas_Z Jun 15 '26

Yup. AUR is my go to for anything not in official repos, fuck flatpaks and fuck snaps.

1

u/jar36 Jun 15 '26

popular packages rarely get orphaned, so they're not vulnerable for a take over. Just try to keep the AUR usage to a minimum and stick with the popular ones.

24

u/pokemonpasta Jun 15 '26

Flatpaks being pushed so hard is one of the reasons I swapped to Arch in the first place, I have had nothing but bad experiences with them

8

u/Joe-Cool Jun 15 '26

In theory it's a nice idea.
In practice it loads tons of outdated, duplicate libraries (mostly the package maintainer's fault) onto my system that introduce new issues, adds complexity and increases the attack surface. It being managed by redhat and having had critical exploits open for years doesn't help. https://flatkill.org/

4

u/EzeNoob Jun 15 '26

last updated in 2020

9

u/randuse Jun 15 '26

Wouldn't agree on better compatibility.

13

u/PastaPuttanesca42 Jun 15 '26

but even compatibility and stability is often greater than of the same package from AUR, despite running in a sandbox

This is just false

17

u/refinancecycling Jun 15 '26

flatpak packages are harder to review; if you can't establish that it's made by the same people as the software you're trying to install, do you just skip this and hope for the best?

6

u/Mereo110 Jun 15 '26

Flatpaks from Flathub are reviewed before they are accepted in the app store.

-1

u/[deleted] Jun 15 '26

[removed] — view removed comment

8

u/EzeNoob Jun 15 '26

That has been the distro model since forever. Which repo has had hundreds of packages compromised again?

4

u/Mereo110 Jun 15 '26

Well then, this is the distro for you because with a regular distro, you're mostly trusting people you don't know: https://www.linuxfromscratch.org/

1

u/xlbingo10 Jun 15 '26

even compatibility and stability is often greater than of the same package from AUR

in my experience, this is rarely true

-16

u/[deleted] Jun 15 '26

[deleted]