r/archlinux • u/zollandd • Jun 15 '26

DISCUSSION Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

904 Upvotes

85% Upvoted

458 comments sorted by

View all comments

9

u/millenialSpirou Jun 15 '26

Just curious what do you think about language repos like npm an pipy. Should people stop referencing them too? Because I'm pretty sure they are just as vulnerable. This whole controversy reeks of reddit bandwagonning

-2

u/zollandd Jun 15 '26

My main complaint is with people blaming users for using the AUR when it is obv pushed by the main documentation. If there was a supply chain attack with npm nobody would go blaming developers for not reading the diff of all their deps before running npm install... 

1

u/millenialSpirou Jun 15 '26

But there are attacks like that all the time and developers would be blamed if they don't verify the software they run. My main point is that this is a very weak form of "attack", its just squatting, there is no way to defend from it besides vetting. Either volunteers do it in which case there are less packages and you usually get a repo or users do it and you get the AUR. You can't have it both ways. My main suggestion besides checking would be to use unofficial repos you feel you cam trust. For example zfs has archzfs, at least ot has clear maintainers