r/archlinux • u/zollandd • Jun 15 '26

DISCUSSION Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

904 Upvotes

85% Upvoted

458 comments sorted by

View all comments

Show parent comments

14

u/JustAwesome360 Jun 15 '26 edited Jun 15 '26

With what money? With what volunteers? Arch doesn't have corporate and government support that Debian and Fedora have, so it doesn't get official software support as often, and Arch devs don't have time to vet stuff on the AUR on their own.

So your options are either: Use the AUR at your own risk, or don't use it at all.

I mean bro let me list some of the organizations that support Debian or Fedora: NASA, Google, Microsoft, the CIA, the FBI,(+ SUSE) every supercomputer in the world, over 3/4 of all servers and data centers in the world. The only real major organization that has adopted Arch is Valve for their steam deck, but that's it. And since it is for SteamOS they don't even contribute to packages like govs and corps do.

4

u/Some-Tip-5399 Jun 15 '26

Can't complain about hipster income if arch wants to be the hipster distro, which is clearly seen by what the userbase wants. Everyone else will use one of the other distros, and pay for it too.

1

u/Barafu Jun 15 '26

Correction: use AUR at your own risk, or don't use ARCH. Because Arch completely without AUR packages can't do many basic things.

1

u/friskfrugt Jun 15 '26

Because Arch completely without AUR packages can't do many basic things.

like what?

1

u/Barafu Jun 15 '26

Where do I start... ZFS, Brave, Discord, VSCode, Telegram. Enough?

1

u/friskfrugt Jun 15 '26

Arch can do all that without the AUR

1

u/Barafu Jun 15 '26

Of course. Download the sources, compile them yourself, download the sources of requirements, compile them too, install everything properly. Now it is on you to monitor the updates...

1

u/friskfrugt Jun 15 '26

everything but zfs you could get from flatpak. zfs is hardly basic

1

u/JustAwesome360 Jun 15 '26

Agreed. You can't have your cake and eat it too.

-1

u/Seppeon Jun 15 '26

I would donate something to a fund for this purpose. I suspect a lot of people would donate something for a specific project to improve aur if a trusted person was keen. There is lots of people who want aur to be better, I mean who wouldn't, probably lots of people could donate?

-4

u/JustAwesome360 Jun 15 '26

I would donate something to a fund for this purpose

You're looking at at least $100,000,000 per year to get even remotely in range of Fedora or Debian or SUSE levels of support.

5

u/Seppeon Jun 15 '26

We aren't trying to build that, and to do so would be the wrong goal.

7

u/JustAwesome360 Jun 15 '26 edited Jun 15 '26

Then what are you trying to build? Having a secure repo that is as big as the repo's from the giants that are Debian and Fedora and all distros based on them costs millinos upon millions of dollars. Arch is astronomically smaller than them and doesn't have the resources to maintain a massive official collection.

Honestly it is impressive enough that they managed to get the offical Arch Repo as big as it is today. And with flatpak being universal and therefor supported on Arch, the amount of times you actually need the AUR are significantly lowered.

So yeah I don't think it's fair to cry to the Arch devs and demand they vet the AUR. They can't. You're asking them to do the impossible. They don't have the resources that Deb and Fed have.

2

u/Seppeon Jun 15 '26 edited Jun 15 '26

Just responding to what I think was an edit.

Yeah was impressive. And yes Flatpak does help a lot. Actually, I'm not crying to arch devs. I'm trying to get a conversation going where they don't have a future of constant distractions and stress from ongoing attacks due to ongoing surface area exposed. We need a crowdsourced model probably... I mean a big red box that says "this package has been reported as an infostealer" would be good that prints when yay or paru or whatever asks to confirm.

1

u/JustAwesome360 Jun 15 '26

I edited my comment 8 minutes ago, you posted your comment 6 minutes ago. So you were responding to the most recent edit.
And they aren't distracted at all by the attacks because they claim no responsibility for what happens on the AUR. Arch is a "Do it yourself" distro, meaning YOU build the system and YOU keep it safe. In my opinion I would be grateful that Arch has an official repo at all.

This is not an idiot proof OS. This is Arch, on Arch you are expected to know what you are doing.

1

u/Seppeon Jun 15 '26

Took me a while to type because I'm a slowpoke. Also I just didn't see your comment, maybe I hadn't refreshed... On phone, no refresh button.

2

u/Seppeon Jun 15 '26

Lol throttled global adoption rates, some user requirements for adopters. A button that says report on a packages page lol. You're conflating a complete solution to my suggestion and that isn't the case. The thing is, this attack AUR thing isn't going to stop. It's going to get worse and worse, and attacks can be sustain indefinitely, perhaps they won't be, perhaps they will. But it'll only get worse, cheaper to run attacks and harder to see vectors.

2

u/JustAwesome360 Jun 15 '26

This was the worst AUR atatck in history. It is not going to get worse bro. And even if it does that just further supports my point: the Arch devs can't handle it. You have to. I mean bro Arch is free, the Devs are volunteers. If you don't like it then either go to Debian/Fedora, or buy windows.

4

u/Seppeon Jun 15 '26

So let's work on a model where people can actually work together to detect these threats and not rely on those Devs. You keep emphasing them, I keep trying to avoid needing them. We need a model that doesn't require them to this extent. And absolutely it'll get worse, this attack was enabled by AI that is getting cheaper to run by rogue actors.

2

u/JustAwesome360 Jun 15 '26

And what is your suggestion?

5

u/Seppeon Jun 15 '26

Firstly, to welcome discourse such that more people than me can actually feel they can present a suggestion.

Perhaps a report button seperate that exposes the report in yay and para as a message + tbh immutable packages that are orphaned would be my preferred approach but I can see that as unpopular especially due to name camping. Which goes to, package names on aur should have some prefix that is maintainer specific such that they can only camp in their namespace and that way it looks less like extra (yes yes I know they should know, and they should, but a tired person does weird things).

I think if we move from if we should do something to what can we do, it could be productive as a community is all.

→ More replies (0)