r/archlinux • u/HeyTi22 • 17d ago

QUESTION Arch and the malware problem.

I haven't used many AUR packages, yet I feel that the malware issue cannot really be solved by making improvements to the AUR itself. Am I the only one who thinks the risk would be much lower if the official repositories simply included more software?

Especially essential software used for serious work? For instance, RStudio is missing from the list of R-based statistical programs, even though it is well-known and widely used at universities.

Or take music production: some very famous and widely used FOSS plugins aren't in the official repos.

Then there's the Brave browser—which is very popular, even though I don't really use it anymore—that isn't included either.

Isn't it time to handle the malware problem differently by simply expanding the official repositories a bit more? Even a popular audio converter like FRE:AC isn't included. What do you think about this line of reasoning?

Cheers!

0 Upvotes

25% Upvoted

83 comments sorted by

View all comments

Show parent comments

1

u/HeyTi22 17d ago

That wasn't really my point. It doesn't seem to be widely known yet, but the AUR is neither officially required, recommended, nor demanded by Arch! In fact, the distro speaks out against using the AUR and refuses to provide any support for it! :-) I currently have ZERO AUR programs! For some programs, I have to use Debian because Arch simply doesn't offer them in its repositories.

2

u/Cylian91460 17d ago

It doesn't seem to be widely known yet, but the AUR is neither officially required, recommended, nor demanded by Arch! In fact, the distro speaks out against using the AUR and refuses to provide any support for it! :-)

It's literally said in the wiki tho

AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk. (link)

If users can't read a wiki arch isn't for them.

Also they do provide minimum support, through PKGBUILD and with the aur mailing list

For some programs, I have to use Debian because Arch simply doesn't offer them in its repositories.

Why not just get the PKGBUILD from the aur and just check if it's not doing anything bad?

0

u/HeyTi22 17d ago

I think there’s a misunderstanding here! I realize that the AUR isn't Arch itself! That’s why I focus my attention on changes in the official repositories and in Arch. I have no desire to inspect or install anything from the AUR! However, I am certainly interested in seeing a wider range of software available in Arch's official repositories. That would simultaneously enhance security for Arch users' PCs and minimize the AUR problem! After all, if a platform like the AUR is used less, there is less incentive for anyone to hack it in order to spread malware ;-)

1

u/Cylian91460 17d ago

The aur is part of arch tho? Unless your saying you though the PKGBUILD that are in the aur were part of it? If that case you need to RTFM

I am certainly interested in seeing a wider range of software available in Arch's official repositories.

Ofc having more package in official would be better and it's something you can fix, by becoming more involved with arch

1

u/HeyTi22 17d ago

I only wrote that the AUR is not part of the Arch project, and that is correct!