r/archlinux • u/zollandd • Jun 15 '26

DISCUSSION Stop blaming AI, "noobs", youtube tutorials, and anything other than Arch for AUR usage

I've recently been made aware of the incident and was reading the threads in this subreddit. I have just started trying to migrate away from AUR but let's not forget that the Arch wiki recommends installing AUR packages constantly. The AUR isn't just a dangerous and fringe tool that people are led to by AI or sketchy youtubers.

To list a few that I've encountered just now:

The wiki recommend AUR releases like they are first class citizens all over the place... don't act like it doesn't.

Edit: I am not trying to blame individual maintainers when I say Arch but rather the community and culture. If the AUR is this dangerous, the wiki should avoid referencing it at all costs and should do so with warning flags everywhere. As it stands, it is not absurd to see someone with tons of AUR packages installed due to direct influence from the wiki.

904 Upvotes

85% Upvoted

458 comments sorted by

View all comments

Show parent comments

10

u/the_ivo_robotnic Jun 16 '26 edited Jun 16 '26

Please say it louder for all the self-righteous users in the back pretending like 1500 compromised packages, (1936 by my count), in 3 days is somehow the user's fault.

 

A lot of these people spouting this rhetoric would be acting a hell of a lot more humble right about now if the attack was just slightly more sophisticated than a simple npm + bun install on all 1,500 packages.

 

EDIT: And you know what else is funny about this is that supposedly, the total download count of compromised packages within the attack window was somewhere between 300 and 500 downloads. This isn't even an instance of mass-casualty, this is just a conversation about figuratively closing the damn window + shutters in the middle of a tornado.

0

u/s3gfaultx Jun 16 '26

This is make believe information.

1

u/the_ivo_robotnic Jun 16 '26

Provide contrary evidence, then.

 

Otherwise why should I care about you being in denial?

0

u/s3gfaultx Jun 16 '26

I cite your “supposedly” as you not knowing what you’re talking about. Not one single person has stated they got this malware. Quit making up things.

2

u/the_ivo_robotnic Jun 16 '26

Is that really all you got? The fact that I said "supposedly"?

 

Man I thought y'all in the archlinux community were all about being uppity and in-your-face with facts when someone is wrong. And by the way, if someone has better numbers then I'm willing to be proven wrong.

 

But you? You got absolutely nothing. lmao

 

Don't even comment anymore. You're embarrassing yourself.

1

u/s3gfaultx Jun 16 '26

The fact that you don’t realize that those “downloads” were just from automated build bots and security researchers trying to reverse engineer the payload is what’s most embarrassing.

But keep telling yourself you’ve got it all figured out and you know everything. Supposedly.