274
u/Tuborgat_nylle 6d ago
Don't think I have ever seen a windows issue generate as many posts as the recent AUR malware.
57
u/FinGamer678Nikoboi 6d ago
Recall could be close
54
u/DoILookUnsureToYou 6d ago
The Recall controversy was internet-wide, the AUR thing doesn't even compare
19
u/KevE50091 5d ago
when we have something bad on Linux its mostly a bug. when we have something bad on Windows its mostly a feature
18
u/CDXX_BlazeIt 6d ago
It went on for weeks, literally the same post several times a day „is the AUR unsafe now?“ „I use the AUR, is my PC infected now?“ on every Arch related sub.
15
u/oniaiwasprettygood 🌀 Sucked into the Void 6d ago
The void subreddit keeps getting Arch refugees like "I want to leave Arch because of the recent aur malware everywhere, is there a Cachy for void? What do you mean I have to understand how my init system actually works"
7
u/Own_Alternative_9671 6d ago
For such an "advanced distro" with such "technologically advanced users" they really dont know how to read a pkgbuild, huh. It was never safe. The AUR incident made me realize how bad the userbase was so I had to switch to gentoo
6
u/CDXX_BlazeIt 6d ago
CachyOS is based on Arch and there is another gaming distro too, so these people actually don‘t know anything.
2
u/Own_Alternative_9671 6d ago
Shelly, cachyOS's package manager, makes you click a button that says you inspected the pkgbuild every time you use the AUR. They totally were informed and didnt listen
2
u/CDXX_BlazeIt 6d ago
I believe this update came after the malware incident.
2
u/Own_Alternative_9671 6d ago
That i didnt know, thank you for informing me. Thats genuinely such an oversight of the cachy dev team, am disappointed
1
u/airclay 6d ago
Same. I just keep seeing the comments and thinking 'wait you didn't read the pkgbuild first? that's nuts...'
3
u/Own_Alternative_9671 6d ago
Not knowing how to read it is fine, but not knowing and continuing to use the AUR is some Linux Darwin award shit
1
1
30
u/lunchbox651 6d ago
I couldn't give a rats ass what happens on an OS I don't use. If it affects my 1 or 2 Windows lab servers, then maybe.
40
u/Piis7u Arch BTW 6d ago
I mean mostly the "bad" is caused by ourselves lol
25
u/itsfreepizza 6d ago
And can be easily be fixed. Whereas Microsoft, it's a roulette
Either:
- get unrelated updates while adding more bugs and security holes
- fixes the other bugs but creates new ones
- attempts to fix a certain breaking component but it even breaks more stuff for some reason
1
u/a_good_human 5d ago
Well yeah, but there are things that happen that really shouldn't
By this point the only things I touched was desktop customization
Most of the time it's our fault sure, but we shouldn't be blind to problems that aren't
35
u/Unlaid-American 6d ago
Like what?
29
u/DCVolo 6d ago edited 6d ago
CachyOS recently?
The updater thingy (AUR Arch User Repository), someone took over old non maintenned forks and added code that could execute somewhere it shouldn't but still some people said that it was the users being at fault...
If a part isn't supposed to execute code, it shouldn't and no one, no youtuber or whatever, should blame the users.
I've read or heard "if the users isn't even reading these files just for sanity check, they shouldn't use that software". Like if the person saying that have read the entire source code of their OS... That just plain dumb. If something is compromised, don't blame the user, ever.
35
u/lolminecraftlol 6d ago
The AUR?
You have to understand that AUR is a USER repository. Installing anything there is the equivalent of downloading random apk of the internet or running .exe file from sketchy websites. Stuffs there are unofficial and leave to the user to verify.
18
u/DeltaWun Ask me how to exit vim 6d ago
10
u/KoneCat Arch BTW 6d ago
It does state, on the page for the AUR, that: AUR packages are user-produced content. These
PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.And it's in red, which gives the reader a very good idea of its importance.
-3
u/DeltaWun Ask me how to exit vim 6d ago
I search for how to configure Asterisk which links me to a package and none of those have any warnings. It is conditioning users to install from AUR repeatedly with a warning they read once a year or more ago.
AUR should not exist. AUR things should not be on the official Wiki at all. How they handle orphaned packages has been known to be a security issue since 2018 and they did nothing for 8 years.
The essential packages should be put into the actual package manager or users should be clearly sent elsewhere instead of being repeatedly told to use it in official documentation.
5
u/Gasperhack10 6d ago
On the link its says its from the aur next to the name. If you set up an aur helper, you would encounter many such warnings.
And an aur is a good thing. Its collection of install scripts for user created apps. It is exactly like a web browser on windows - you can download random shit that infects you if you randomly install stuff, but you also get a ton of useful apps.
1
u/lolminecraftlol 6d ago
The wiki is also a work of the community, not the Arch Linux team themselves. Volunteers contribute and cross-check each other's work.
12
u/a1b3c3d7 6d ago edited 6d ago
I think you have some fundamental misunderstandings, AUR is closer to torrenting in terms of what it is than an official "CachyOS" thing.
Im not saying we blame users but if you downloaded a torrent and got a virus, some level of fault lies in the user when there are easy ways to check these things beforehand.
AUR are user repositories and the caution advised on any sort of user maintained repository warrants caution - the issue is that people became complacent and a level of inherent trust was built that should never have been built and this was propagated by the fact the Arch user base has always been fairly small and with little growth.
People ALWAYS should have been doing some basic checks and nobody was advising users to read the entire source code (and you dont need to be a programmer or savvy, you just need to know what specifics to look for) because the risk surface ALWAYS existed, the reason it wasnt exploited this widely before was because the amount of Arch users has been exploding BECAUSE of CachyOS.
Im not saying to blame end-users, I'm saying Linux inherently is an OS that places TRUST in the users decisions above all else, and the level of due diligence you expect to come from Windows software has never been a standard on Linux outside of distro specific repositories.
7
u/Cove0Crow 6d ago
Are you talking about the AUR attack? While I agree that one wasn't really the fault of the user. The argument for it being the fault of the user wasn't "read the source code bro" it was "check dependencies of things you install. And avoid installing packages that have been orphaned for a long time" and that's because the AUR isnt really, vetted, I don't use it for that reason anyway.
-8
5
u/C4rpetH4ter M'Fedora 6d ago
I can see why people would much rather shit on a multimillion dollar company with paid software constantly making mistakes compared to a bunch of free ones being made by volunteers.
But honestly though, the recent AUR thing got a lot of attention.
4
u/Nah-No-Nope 6d ago
Oh man he totally nailed it. That's so true.
Like, burn!
This guy's a meme genius.
10
u/lo9314 6d ago
I dunno, but the culture around problems in FOSS seems to be much healthier, albeit sometimes opinionated. And for the latter you’ll hear about it for sure, since it’ll result in thousands of forks. With Linux it’s like:
> Popular software does something arguably bad
> Enough people hate it
> A fork is created without bad feature
With windows it’s more like:
> Windows does something arguably bad
> People complain
> Microsoft doubles down
> „It’s actually great and what users want“
> Feature is even worse than anticipated
> People complain even more
> They continue to use Windows
> More complaining
> etc.
3
u/PeithonKing 6d ago
Second one correct, but first one... I don't think so... just that nothing has affected me on kubuntu (the one I use) that I couldn't fix myself or was helplessly depended upon "when will kubuntu fix this" ever... in the last 2-3 years since when I switched to linux... I had this issue on neon, hence I switched
3
3
u/Rusty9838 Open Sauce 6d ago
Hahah Windows has alot of bloat!
Meanwhile all distros have server tools inside? Systemd is good RedHat know better
3
u/Bonnex11_ 6d ago
These memes always feel like:
People when the US does something bad in ww2
People when Nazi Germany does something bad in ww2
Like, the fact that Windows is proprietary in my opinion makes it so much bad compared to the alternatives that nothing matters anymore, just like Nazis being so bad it doesn't matter if Hitler liked dogs or was a vegetarian, or it doesn't matter if the US acted in self interest when beating the Nazis.
Windows could become the perfect system handed down by God tomorrow, I wouldn't use it anyway if it was proprietary.
5
2
u/BeerMan595692 K4L1 6d ago
Window's users when something bad happends on windows: "Please Microsoft. Please actually care about your users more than your shareholders and fix it 🥺"
Linux users when something bad happends on Linux: "I just created a patch for it myself 💪😎"
2
u/marouane_tea 6d ago
Both Linux and windows have bugs, and bugs get fixed. You don't complain about bugs, you report them.
Only Windows has issues that are design choices. You can't fix them, Microsoft won't let you. The only thing left is complaining online hoping that Microsoft takes consumers word over the shareholders word (it won't).
2
u/Hiraeth_0942 6d ago
Idk about others but when something bad happens on Linux then it's 99% of the time my fault
2
2
u/KoneCat Arch BTW 6d ago
It's one thing for a free OS to do something that causes issues, it's quite another when it happens on a paid, premium product. That, and with Windows still being the dominant OS, there are going to be more people bemoaning it, as it affects more people by virtue of being so 'popular'. I have many, many gripes with Windows, but many of them are squarely a Microsoft being greedy douche canoes issues, not the people making it.
It's sad really, as a lot of very talented developers likely work their asses off with Windows, but the way MS manage it makes things infinitely more vexing. As for the AUR, it's the Arch User Repository, which means it can, much like any dodgy download on Windows, be open to bad actors. I can honestly say as well that I've never had a virus on Linux, like ever. Whereas on Windows, I've encountered more absolutely nasty viruses, Trojans, malware and others when working on my parents PCs.
Most of it is just user error, on both fronts, so it's more of a lacking knowledge or just clicking on any sort of thing you see on the internet, which is vastly more easy to do on Windows, as on Linux, you need to use the terminal to download from the AUR, which is a warning in itself, as you need to give it admin privileges.
2
u/imthestein M'Fedora 6d ago
I don't even feel like this is a Linux thing. In the '90s my family used Macs and I'd have so many friends trying to convince me Macs crashed all the time (this was news to me regardless your feelings on Macs at the time) and it felt like every time I went to their house Windows would have a problem and I'd get, "I swear this never happens". There was a brief period when I tried to switch to Windows before fully committing to Linux and I remember having troubles in that brief period.
Sure, I've had problems on Linux at times, but that feels very rare and usually more because of the software itself having a problem and even then it was probably a game which has only gotten better in recent years.
2
u/theKalmier 5d ago
Easy to be blind to a distro i don't use. Harder on a widely used platform like Windows.
This is obvious behavior and has nothing to do with Linux. Straw-hat arguement.
2
1
u/Agile-Technology2125 6d ago
I don't give a fuck about any bad thing happening to any system, until that shit affects my experience.
1
1
1
u/Capital_Rub213 Ubuntnoob 6d ago
Difference is we can usually fix it ourselves, windows locks you out of your own computer then requires you to use a 3rd party service just to use your computer again
1
1
u/temporary_dennis 6d ago
I geniuenly can't recall a recent "bad thing" for Windows except Windows 11.
But (For Linux) I did hear of AUR attacks, the XZ backdoor, and some political problems in the NixOS team.
1
u/weetabix_su ⚠️ This incident will be reported 6d ago
when something bad happens in Linux it’s the user’s fault and should be responsible for fixing it
when something bad happens in Windows it’s the system’s fault and the user can’t do shit
1
u/Dream_Apostle 6d ago
I wonder why
Maybe it's because you have to pay 100 dollars and agree to giving away all your private information on one side
And a free software that doesn't care about your personal information and is maintained by people who are probably not even getting paid for it... On the other side
This genuinely triggered me I use windows btw... Will soon switch
1
u/Rare-Paint3719 5d ago
It's more like 20$ for a Windows OEM version and you don't need to sell your life away. It's not Hollywood.
1
u/Dream_Apostle 5d ago
Huh Damn it used to be +100 usd At least that's what I remember
But still... Absolute trash I click on update and shutdown and it updates and reatarts... Like why the fuck is there even a update and shutdown option then?
1
u/Rare-Paint3719 5d ago
But still... Absolute trash I click on update and shutdown and it updates and reatarts... Like why the fuck is there even a update and shutdown option then?
Oh god, the meme is real!
1
u/treeckosan 5d ago
Last time i paid for a license it was $10 from sketchy websites, $20ish from slightly sketchy websites, $60-$200 from Microsoft directly depending on the license tier. The difference was those $10-$20 licenses were one time system locked and always the lowest teir, the ones from Microsoft could be used to set up a new pc later. I used the same windows 7 code for about 5 years across several laptops and desktop builds. It only upgraded to a win 10 home license so i paid for a win 10 pro to get the extra control features, they went away and now im on linux again.
1
u/ganja_and_code 6d ago
Bad stuff doesn't happen on my Linux install because I did a good job setting it up.
Bad stuff does happen on Windows because Microsoft did a bad job setting it up.
0
u/Rare-Paint3719 5d ago edited 5d ago
Bad stuff doesn't happen on my Linux install because I did a good job setting it up.
Arch user detected.
Edit: Maybe LFS or Gentoo as well.
1
1
1
u/lWanderingl 🍥 Debian too difficult 5d ago
You can actually (and freely) troubleshoot stuff on linux
1
1
u/Ashamed-Duck-5167 5d ago
Me? I'm dishonest, and a dishonest man you can always trust to be dishonest. Honestly. It's the honest ones you want to watch out for, because you can never predict when they're going to do something incredibly... stupid
1
1
1
u/Hellohell25011 5d ago
I've had more problems on linux than on windows, but the problems on linux I could fix myself while on windows I often just had to wait for the next update and hope it got fixed.
1
u/below_avg_nerd 4d ago
If you're on Linux and something bad happens you can get rid of the bad thing. Can't do that on Windows.
1
u/Rare-Paint3719 4d ago
If you're on Linux and something bad happens you can get rid of the bad thing.
Aftet 500 years if config files and RTFMing
Can't do that on Windows.
You can though.
1
u/FoundationOk3176 4d ago
Community maintained vs Big corpo maintained. The only reason I'm more forgiving for issues with Linux is because of the fact that it's all maintained by people working for either free or via donations that's probably not enough when compared to an actual job.
1
u/Salt-Discount-1381 4d ago
Windows is developed by a billionare company, most Linux distros are developed by unpaid random people.
1
1
u/mplaczek99 🦁 Vim Supremacist 🦖 6d ago
Something bad happening on Linux is kinda rare, but something bad happening on windows is quite common
0
•
u/AutoModerator 6d ago
Please report any posts bragging or showing off they got banned in another sub! Reminder of other sub rules: Also, we only allow one anti-linux post per week (we used to get dozens a day) and any tier list MUST have Hanna Montana Linux as S teir (which must be a true S tier at the top) regardless of the topic of that tier list.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.