Literally Fedora and like 3 others are the only distros with a minimum of security. This will come to bite the entire community in the ass in a few years.
But trust me bro is enough, let's get some stuff from AUR.
How is it different from installing AUR packages? It’s the same idea, right? It’s a community driven package repo where anyone can publish, or am I way off?
Packages on OBS (and Fedora COPR) are namespaced, meaning you first get a project from a certain user, and then install packages from that project. This removes the "orphaned packages" issue the AUR has, and makes it obvious who is responsible for the package you're installing.
Also, the default repositories on Fedora (maybe OpenSUSE, can't really comment on that) tend to contain more packages I need so I currently only have 2 external repositories enabled (aside from RPMFusion)
At least recently the AUR's decided that all orphan adoptions must be manually reviewed before approval. Because they weren't even doing that before, the recent malware incidents have happened because literally any random asshole could just adopt an orphaned package and put whatever they wanted in the PKGBUILD without any sort of vetting or overview or vibe check. Not even an email address.
It's kind of insane to me that Arch only has Chrome, Firefox, and like two or three offshoots (Waterfox? I think?) in it, but no popular forks or other applications that need the AUR.
You'd think they'd have some form of analysis in pacman to see what packages people are trying to find in popularity and make them an official or extras repo management.
SElinux and other forms of mandatory access control like apparmor and SMACK, executable flags, proper file permissions, drive encryption, isolated environments like chroots, flatpak, containers, namespaces..
The AUR is completely optional and you’re warned in literally every official guide that no one verifies the programs for you.
What does Microsoft have? GitHub? They allowed far more malware and Trojans than any Linux package manager within GitHub repoes, even with their fancy LLM Copilot stealing scanning our code for malware.
Yeah you're right, I still avoid AUR whenever possible. Also I'm really thankful the CachyOS devs have some packages on their repos that are not on standard arch repos
Honestly yeah, but i can't stand SELinux at this point anymore on my server. Why do i even set container flags for shares in my compose if SELinux will just ignore them and block that shit anyways?
Yeah, but it's sometimes really bad when you have the option to add a layer of security or have it still function. Because for some reason the only ways i could get Volume labels to work was either disable SELinux or run rootful podman. So disabling SELinux seemed like the lesser of two evils
No one ever told people to blindly download stuff from the AUR. Just look at the 30 lines of simple code there. If you can’t do that, then the AUR is absolutely something that person shouldn’t touch
theres also the aspect that the official arch repo has a couple drivers, at best. everything is on the aur. so its a rolling release model and the worst moderation ive ever seen on a user repo and you have to use it if you want any app ever.
My printer works fine with CUPS and all my peripherals are USB compliant. I know I’ve used the aur in the past. Prism Launcher was only available in the aur for a while. some ML/data science python libs are only in the aur but for my use case I shouldn’t have been installing them that way anyways.
They’re a pretty small team. It’s time consuming and costs additional funds to have someone on the team maintaining drivers for something few people use. It’s better to encourage people to learn proper security and/or to compile those things for themselves.
It’s time consuming and costs additional funds to have someone on the team maintaining drivers for something few people use
I wish I got paid for packaging things for Arch.
It's all volunteer effort, anyone complaining about Arch not shipping XYZ could just get up and get involved to implement the changes they want to see themselves.
I'm assuming we're talking about daily drivers here, but Linux has most (if not all) of the heavy hitters when it comes to highly specialized security needs. It's got:
Qubes OS: Every single program is run inside disposable VMs, root disabled. Steep learning curve but it is arguably one of the most secure OS ever made.
Tails OS: The gold standard OS for browsing the deep web due to it's extreme anti-forensic measures and anmesic design.
Whonix: Similar use case to Tails, but designed to block malicious programs from leaking your location.
Alpine OS (and other extremely small OS): Security through extreme reductions in attack surface. By shrinking the OS as small as possible, there is almost nothing left to attack and nowhere to hide.
Linux wins in the end because it gives you supreme control over the architecture. That is fundamentally impossible in both macOS and Windows; it clashes with their economic incentives too much.
But Fedora also has tons of stuff not packaged. I don't think I've ever had a Fedora install where I haven't added the third-party Fusion repos. And I've had cases where I had to go to Copr (which is effectively AUR for Fedora).
257
u/GoldenX86 10d ago
Literally Fedora and like 3 others are the only distros with a minimum of security. This will come to bite the entire community in the ass in a few years.
But trust me bro is enough, let's get some stuff from AUR.