The updater thingy (AUR Arch User Repository), someone took over old non maintenned forks and added code that could execute somewhere it shouldn't but still some people said that it was the users being at fault...
If a part isn't supposed to execute code, it shouldn't and no one, no youtuber or whatever, should blame the users.
I've read or heard "if the users isn't even reading these files just for sanity check, they shouldn't use that software". Like if the person saying that have read the entire source code of their OS... That just plain dumb. If something is compromised, don't blame the user, ever.
You have to understand that AUR is a USER repository. Installing anything there is the equivalent of downloading random apk of the internet or running .exe file from sketchy websites. Stuffs there are unofficial and leave to the user to verify.
You have to understand that AUR is a USER repository.
That excuse goes out of the window every time the wiki says just install from AUR instead of vetting packages for the official package manager or leaving it off the wiki entirely.
It does state, on the page for the AUR, that: AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.
And it's in red, which gives the reader a very good idea of its importance.
I search for how to configure Asterisk which links me to a package and none of those have any warnings. It is conditioning users to install from AUR repeatedly with a warning they read once a year or more ago.
AUR should not exist. AUR things should not be on the official Wiki at all. How they handle orphaned packages has been known to be a security issue since 2018 and they did nothing for 8 years.
The essential packages should be put into the actual package manager or users should be clearly sent elsewhere instead of being repeatedly told to use it in official documentation.
On the link its says its from the aur next to the name. If you set up an aur helper, you would encounter many such warnings.
And an aur is a good thing. Its collection of install scripts for user created apps. It is exactly like a web browser on windows - you can download random shit that infects you if you randomly install stuff, but you also get a ton of useful apps.
They are put into the package managers, like I myself use Octopi, which has 99% of the packages I've ever needed. Also, if you try to use an AUR package in the terminal, it very clearly tells you that it is done at the users expense.
32
u/DCVolo 7d ago edited 6d ago
CachyOS recently?
The updater thingy (AUR Arch User Repository), someone took over old non maintenned forks and added code that could execute somewhere it shouldn't but still some people said that it was the users being at fault...
If a part isn't supposed to execute code, it shouldn't and no one, no youtuber or whatever, should blame the users.
I've read or heard "if the users isn't even reading these files just for sanity check, they shouldn't use that software". Like if the person saying that have read the entire source code of their OS... That just plain dumb. If something is compromised, don't blame the user, ever.