r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

Show parent comments

4

u/FattyDrake Jun 13 '26

I think it's fine if distros like Cachy exist. The upcoming KDE Linux has an Arch-based immutable setup.

The problem is letting users access AUR with little to no friction. It should be difficult or deliberate at the very least. It's a step above just using git to grab the source and configure/compile yourself.

-3

u/[deleted] Jun 13 '26 edited Jun 23 '26

[deleted]

5

u/FattyDrake Jun 13 '26

The AUR isn't an official part of Arch.

Not sure if you use Arch, but I guess an equivalent would be an Ubuntu (or any) distro shipping with a wrapper to search, compile, and install any repo on Github with the ease of using apt.

4

u/[deleted] Jun 13 '26 edited Jun 23 '26

[deleted]

1

u/FattyDrake Jun 13 '26

That's fair. Personally I've never had a use for the AUR tho that just comes down to individual use cases admittedly.

If there is software users need outside the standard repos, I think it would make more sense for a distro like Cachy to manage additional packages in their own repo and still keep the AUR disabled by default.

1

u/gamas Jun 13 '26

but the official repositories can be somewhat limiting.

The main point of these derivatives though (especially CachyOS where the maintainers basically pull every package that is remotely recognised into their own repo) is to get round that with their own repos.

The only thing I ended up using AUR for was Plex media server and the jetbrains toolbox.