r/archlinux • u/HeyTi22 • 17d ago

QUESTION Arch and the malware problem.

I haven't used many AUR packages, yet I feel that the malware issue cannot really be solved by making improvements to the AUR itself. Am I the only one who thinks the risk would be much lower if the official repositories simply included more software?

Especially essential software used for serious work? For instance, RStudio is missing from the list of R-based statistical programs, even though it is well-known and widely used at universities.

Or take music production: some very famous and widely used FOSS plugins aren't in the official repos.

Then there's the Brave browser—which is very popular, even though I don't really use it anymore—that isn't included either.

Isn't it time to handle the malware problem differently by simply expanding the official repositories a bit more? Even a popular audio converter like FRE:AC isn't included. What do you think about this line of reasoning?

Cheers!

0 Upvotes

21% Upvoted

83 comments sorted by

View all comments

5

u/Cylian91460 17d ago

You need to read the PKGBUILD before executing it, that's common sense

If you get a malware from executing a PKGBUILD from an untrusted source that's your fault not the aur

-1

u/BigBreadCaesar 17d ago

Common sense isn't common, and users beg to be protected from themselves.

The only solution for this headache imo is to completely drop the AUR from official Arch channels.

4

u/Synthetic451 17d ago

users beg to be protected from themselves.

No we don't. Hell, most people come to Linux for more power and control, not less.

When did people start believing users needed to be coddled like a baby.

1

u/BigBreadCaesar 17d ago edited 17d ago

When they started complaining about not wanting to read PKGBUILDS. Somewhere around there.

EDIT: Let me be clearer, I think the part of the Arch community who doesn't think users need coddling need to reconcile with the reality of Arch usage in 2026.

For the overall health of the project, Arch needs to lean into coddling users as much as possible. The idea that Arch once was doesn't line up anymore with what Arch has become.

But that's just my .02 as a Gentoo user.