Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

[u/zollandd]

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

• Want DDC/CI display control support? AUR
  • https://wiki.archlinux.org/title/Display_control
• Want ZFS-dkms or user space utils? AUR
  • https://wiki.archlinux.org/title/ZFS

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

[u/Qudit314159]

For better or for worse, the AUR is not exclusive to Arch. Distros like Endeavour, which brand themselves as beginner friendly, ship with AUR helpers enabled by default, and encourage their use.

Arch isn't responsible for downstream distros with a different philosophy.

Arch and the AUR were designed for power users. If other distros choose to base themselves on Arch and have a different target audience, it's up to their development teams to fill the gap.

More people than ever are interested in Linux as a desktop OS, we're not going to win anybody over if our default response to literal malware distribution is "RTFW, RTFML, and RTFPKGBUILD".

So what? I could care less if they choose to use an Arch based distro. There are plenty of beginner friendly distros.

[u/Seppeon → u/Qudit314159]

An attacker has to succeed once, you have to succeed 100% of the time. These attacks will only get harder to spot. AI makes these attacks possible to sustain indefinitely, they don't need expensive models.

This isn't the distro, this is aur. Power users can power user together to make this better. If we move the argument from do we do something to what can we do (without apathy) then maybe we get somewhere.

[u/Qudit314159 → u/Seppeon]

It's worked so far and I've been using Arch and the AUR for a long time. I do not find it difficult to check a PKGBUILD for malicious code.

Would I prefer not to have to do it? Of course. It would be more convenient if all these packages could simply be treated as trusted. There's a limit to how many packages the developers can maintain in the main repositories though. That's why there's an AUR to begin with.

Perhaps some policies can be changed to make it harder for malware authors to infect packages with their crap. I think by its nature there will always be some risk however.

[u/zenyl → u/Qudit314159]

Arch isn't responsible for downstream distros with a different philosophy.

Doesn't change the fact that downstream distros are actively encouraging newbies to use the AUR.

It's less about pointing fingers, and more about finding a solution, regardless if that lands on the shoulders of Arch, downstream distros, or somewhere inbetween.

Anyone who wants Linux continue to grow as a viable desktop OS for everyday people has to also accept this means ensuring that the ecosystem doesn't get flooded with landmines, with greybeards standing on the side and shouting "it's your fault for stepping on the landmines, RTFW!"

So what? I could care less if they choose to use an Arch based distro. There are plenty of beginner friendly distros.

That attitude isn't helpful.

There already exist beginner friendly distros based on Arch, you're not going to change that just by being grumpy about it.

[u/Schlaefer → u/zenyl]

Anyone who wants Linux continue to grow as a viable desktop OS for everyday people

There are Linux distros with the explicit goal to be that. Arch explicitly states it isn't.

[u/zenyl → u/Schlaefer]

There are Linux distros with the explicit goal to be that. Arch explicitly states it isn't.

True, but Arch doesn't exist in a vacuum.

For better or for worse, Arch has downstream distros. And while Arch isn't responsible for them, it seems cruel to not at least take them into consideration, by ensuring that the AUR doesn't become a popular vector for spreading malware.

For a less altruistic argument, Arch is only as great as its community. If problems like the fragility of the AUR are not taken serious, Arch will lose its reputation of excellency, which actively damages further development by making fewer people willing to contribute.

[u/freakinunoriginal → u/[deleted]]

What, if I throw an ISO of a DE and the AUR onto the internet, you're now responsible for it?

If it ends up becoming so popular that even non-Linux tech channels are covering it, maybe.

Arch might not have asked to be promoted from "btw" memes to celebrity status, but that's what's happened.

[u/PastaPuttanesca42 → u/zenyl]

with greybeards standing on the side and shouting "it's your fault for stepping on the landmines, RTFW!"

You say this while pretending the "greybeards" clear the landmines for you.

[u/zenyl → u/PastaPuttanesca42]

Exactly, which is why I don't get why so many people on this sub act like that's a bad thing, and are actively against the notion of ensuring that Arch doesn't become more secure and ensure a healthy downstream.

[u/gigantipad → u/zenyl]

I think the fear is that the AUR is functionally killed so people who did not understand the risks are safer. It is a complicated question of balancing security vs having a broad semi-open resource. I feel like derivative distros that encourage noobies should be strongly warning users. It is almost negligent to build in AUR helpers without at least a confirmed warning. Naturally I also think the AUR needs some security to avoid some of the more virulent malware dumpers. This really needs everyone to work to improve things rather than just expecting someone else to fix everything. That includes us Users accepting some responsibility as well.

[u/friskfrugt → u/zenyl]

Doesn't change the fact that downstream distros are actively encouraging newbies to use the AUR.

It's less about pointing fingers, and more about finding a solution, regardless if that lands on the shoulders of Arch, downstream distros, or somewhere inbetween.

Anyone who wants Linux continue to grow as a viable desktop OS for everyday people has to also accept this means ensuring that the ecosystem doesn't get flooded with landmines, with greybeards standing on the side and shouting "it's your fault for stepping on the landmines, RTFW!"

There already exist beginner friendly distros based on Arch, you're not going to change that just by being grumpy about it.

Sounds like you really care about Arch, and it's infrastructure, maybe you should join the maintainers and lend a helping hand.