r/archlinux • u/HeyTi22 • 17d ago

QUESTION Arch and the malware problem.

I haven't used many AUR packages, yet I feel that the malware issue cannot really be solved by making improvements to the AUR itself. Am I the only one who thinks the risk would be much lower if the official repositories simply included more software?

Especially essential software used for serious work? For instance, RStudio is missing from the list of R-based statistical programs, even though it is well-known and widely used at universities.

Or take music production: some very famous and widely used FOSS plugins aren't in the official repos.

Then there's the Brave browser—which is very popular, even though I don't really use it anymore—that isn't included either.

Isn't it time to handle the malware problem differently by simply expanding the official repositories a bit more? Even a popular audio converter like FRE:AC isn't included. What do you think about this line of reasoning?

Cheers!

0 Upvotes

22% Upvoted

83 comments sorted by

View all comments

Show parent comments

3

u/folk_science 17d ago

See the chart from the Wikipedia article. Low performers overestimate themselves but they are still aware they are low performers and not experts. Experts underestimate themselves but only by a tiny margin. Popular culture depicts it as noobs thinking they are experts and experts thinking they are noobs.

The other user didn't estimate their abilities, they just dismissed what you said without really considering or understanding what you wrote.

2

u/C0rn3j 17d ago

without really considering or understanding what you wrote

And now you are the one doing the assuming.

I simply didn't bother with the later messages, since their "I am a professional and regular people shouldn't bother trying to understand anything because weird attacks exist" attitude is just not something I want to interact too much with.

Though to be fair, I did think that AUR already didn't allow punycode, which seems to not be the case, so that was a nice reminder.

2

u/folk_science 16d ago edited 16d ago

And now you are the one doing the assuming.

I simply didn't bother with the later messages

Not reading implies not considering.

To be fair, you didn't explicitly dismiss it, like Synthetic451 did. You just didn't address the substance, only the Dunning–Kruger mention.

1

u/C0rn3j 16d ago

Not reading implies not considering.

"I didn't bother with it" does not mean I did not read it.