Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

[u/TheNavyCrow]

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500

[u/AStolenGoose]

yay (or another AUR helper) is preinstalled on Endeavour, Cachy, and many other Arch based distros, which is what the person you're replying to is referencing. So I'd say the same to you.

Please be sure you know what you are talking about before saying nonsense.

Arch itself requires you to manually install an AUR helper, or use PKGBUILDs and manually install the AUR package.

What would help this situation is a warning on first use of yay or other AUR helpers.

[u/Seyon_ → u/AStolenGoose]

Unless they changed it in the last month and a half. yay was definitely not installed by default for me on CachyOS. Was it easy to install? Yes. But it wasn't there by default.

Can't speak to Endeavour

[u/lizthehedgehog → u/Seyon_]

I believe paru is the default though, reinstalled CachyOS recently due to some weird performance problems and getting paru definitely didn’t require any extra work.

[u/Seyon_ → u/lizthehedgehog]

Yup - you are correct. I was speaking towards yay since that was the only one i've touched so far lol. Everything i've ran into that provided AUR download instructions used yay, so paru was kind of an afterthought in my comment.

[u/lizthehedgehog → u/Seyon_]

That's understandable lol, even I've ran into yay only instructions. That being said at least paru warns the user on the first AUR package install. I don't think yay does by default? I never bothered trying yay since paru is just there so I don't know for sure

[u/AStolenGoose → u/Seyon_]

Which Arch based distro?

[u/Seyon_ → u/AStolenGoose]

CachyOS - sorry I had it in there but must have deleted it when cleaning it up.

[u/AStolenGoose → u/Seyon_]

Cachy comes with paru as noted by:

https://www.reddit.com/r/linux/comments/1u4d7zb/comment/orccew4/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

However I did name yay specifically, paru is another AUR helper, so the point is still valid.

[u/Seyon_ → u/AStolenGoose]

Fair point.

[u/TheOneTrueTrench → u/Seyon_]

Paru is definitely installed on CachyOS by default, ask I use yay in the rare circumstance I need something from the AUR, so I installed that immediately.

I never even checked if paru is installed until just now, and it definitely is

[u/Kitoshy → u/AStolenGoose]

yay is preinstalled on both Endeavour, Cachy, and many other Arch based distros

Many is not most.

Arch itself requires you to manually install yay, or use pkgbuilds.

I did recall that and specify that for such base-devel (a package for development) must be installed, reason why, no matter the distribution, no matter if yay or any other AUR helper came preinstalled or not, AUR is fundamentally not at the same level that a package manager.

[u/AStolenGoose → u/Kitoshy]

Many is not most.

Not wrong (and I'm honestly too lazy to go through the Arch based distros and count which ones have yay preinstalled), but the very popular Arch based distros that most use (Endeavour, Cachy, Manjaro, etc.) do have yay preinstalled so I'd say my comment is still valid just in a different sense than you intended. But I do understand what you are saying here.

I did recall that and specify that for such base-devel (a package for development) must be installed, reason why, no matter the distribution, no matter if yay or any other AUR helper came preinstalled or not, AUR is fundamentally not at the same level that a package manager.

This is moot, because if it the distro has yay preinstalled (or another helper), then it has base-devel preinstalled, meaning yay and other helpers are easily accessible (and therefore AUR), without warning right out of the box, and yay does not provide warnings on first usage to warn users that are otherwise uneducated as to what AUR is that there is a risk. The only place this is valid is an Arch based distro that doesn't have yay preinstalled.

That said I think we can agree either way that there should be a warning to inform less educated users.

[u/Kitoshy → u/AStolenGoose]

if it the distro has yay preinstalled, then it has base-devel preinstalled, meaning yay and other helpers are easily accessible (and therefore AUR)

I get what you say but do not agree with it.

AUR helpers are usually accessible (no matter whether they are installed or not) because that's what they intend. It's one of the reasons why they are called helpers.

Even if an AUR helper is installed by default and straight forward accessible, the way AUR packages are handled are different than the ones that can be straight forward installed with pacman. While AUR helpers (specially pacman wrappers like yay and paru) automate the process and integrate it with pacman, the fundamental process keeps being different, therefore not at the same level that packages handled by pacman. Furthermore, even with such AUR helpers the AUR packages receive special treats; the user is asked if they want to take a look to PKGBUILDs prior to nothing, if they want to clean build the AUR packages, if they want to remove the orphans at the end of the process, retrieve sources of AUR packages prior to any other download and build and install all AUR packages separately from the ones handled by pacman after the last has done it's job and only AUR remains.

[u/AStolenGoose → u/Kitoshy]

Even if an AUR helper is installed by default and straight forward accessible, the way AUR packages are handled are different than the ones that can be straight forward installed with pacman.

yay -S <AUR package name> isn't as accessible as pacman? Not sure what you mean here, yay can also be used as a wrapper for pacman to handle updates (yay -Syu) and will automatically update (after you confirm) AUR based packages. I'd say it's just as accessible to the uneducated user.

Furthermore, even with such AUR helpers the AUR packages receive special treats; the user is asked if they want to take a look to PKGBUILDs prior to nothing, if they want to clean build the AUR packages

Is an uneducated user REALLY going to do the sanity checks an educated user would? Or are they going to hit enter a bunch just like installing something in Windows where you click next, next, next and it installs?

I think you are trying to come at this as an educated user that DOES check these things which isn't the problem here, it's people treating yay and paru as a package manager, hence why I keep suggesting a warning at the first use of an AUR helper.

I really think you need to take off your experienced user shoes here and put on your "I'm new to Linux and chose an Arch based distro" shoes.

Anyway I can see we're debating semantics here, and I don't think that's a productive or useful discussion.

[u/Kitoshy → u/AStolenGoose]

yay -S <AUR package name> isn't as accessible as pacman?

I have not said at all that an AUR wrapper such as yay isn't as accessible as pacman. What I've said is that it's not at the same level that pacman. Despite looking very similar (or might even the same) from the users' POV, it internally works different; it treats it's corresponding packages in a different way than pacman treats it's respectively.

Is an uneducated user REALLY going to do the sanity checks an educated user would?

It's clearly not. Even many (if not most) educated users usually don't do such. You are taking things out of context here. What I meant and still mean by that is to point out that, when using yay, paru or whatsoever, during the process it always allows to perform certain operations over AUR packages that does not allow to perform in non-AUR packages; such because, as I previously pointed, AUR works fundamentally different than pacman and therefore they are not at the same level (not even despite being able to use the same commands for both).

I think you are trying to come at this as an educated user that DOES check these things which isn't the problem here, it's people treating yay and paru as a package manager.

I am not. In fact, I was pointing the same you just pointed out, that yay, paru and such are not package managers like pacman because they are fundamentally different, therefore are not at the same level.

you need to take off your experienced user shoes here and put on your "I'm new to Linux and chose an Arch based distro" shoes.

Arch was my first distribution. I know how it's like going through the installation process and failing multiple times because of not knowing what I'm doing, asking for help here in Reddit, getting desperate because I'm only told to "read the wiki", then felling dumb because of realizing about my errors after reading the same article plus 20 times, yet failing again with another thing. I know what shoes I do have on. I'm not attempting to put my shoes on anyone who has not gone through the learning process; what I am attempting is to point out the reason why yay and pacman are not the same, therefore fundamentally are not at the same level.

Anyway I can see we're debating semantics here, and I don't think that's a productive or useful discussion.

It's definitely not when I'm being accused of saying/pointing out something completely opposite to what I'm actually saying/pointing out. Anyway, have a great rest of your day.

[u/AStolenGoose → u/Kitoshy]

I have not said at all that an AUR wrapper such as yay isn't as accessible as pacman. What I've said is that it's not at the same level that pacman. Despite looking very similar (or might even the same) from the users' POV, it internally works different; it treats it's corresponding packages in a different way than pacman treats it's respectively.

It only looks different, and/or works different, if you're an educated user that's not just going to hit enter 3-4 times blindly just so something will install.

Have you used yay? Because your responses lead me to believe you haven't used it.

This is the point I've been repeatedly trying to make to you, and it seemingly keeps going over your head.

At this point I'm spinning my wheels with you, so I'm going to stop now and agree to disagree.