The entire philosophy of Arch is to put user in control. The PKGBUILD format is plain-text and reviewable. The documented best practice has always been to read the PKGBUILD and the .install files before building.
I’m not saying they shouldn’t look into measures to make it less prone to such attacks, but “take it down” is a very stupid take. If people can’t deal with the existence of AUR, there’s plenty of different distros to choose already.
I get what you mean, but people are stupid. There needs to be guardrails to prevent these things from happening. That’s why the AUR is a bad idea and it should be shut down.
You want your software to be available for a distro? Go through the proper channels. Submit it for review and get it approved. If you stop maintaining it, they remove it. Plain and simple.
That’s why you don’t have this problem with other distros. Arch made it too easy to download and install unverified, untested, potentially malicious software through the AUR and now every idiot that thinks they know what they’re doing are infecting their systems.
There are some software that I only have because of AUR. For example, Brother printer drivers.
AUR is a great option to have. It doesn’t mean people should use it for everything, when there’s a perfectly capable version of the same software downloadable from Arch, Flathub or even through Distrobox.
Having options is a good thing, people just need to take care.
In fact, downloading something from AUR without checking it is hardly more dangerous than adding PPAs in Ubuntu.
The entire philosophy of Arch is to put user in control. The PKGBUILD format is plain-text and reviewable. The documented best practice has always been to read the PKGBUILD and the .install files before building.
I’m not saying they shouldn’t look into measures to make it less prone to such attacks, but “take it down” is a very stupid take. If people can’t deal with the existence of AUR, there’s plenty of different distros to choose already.
In control of installing malware?
I get what you mean, but people are stupid. There needs to be guardrails to prevent these things from happening. That’s why the AUR is a bad idea and it should be shut down.
You want your software to be available for a distro? Go through the proper channels. Submit it for review and get it approved. If you stop maintaining it, they remove it. Plain and simple.
That’s why you don’t have this problem with other distros. Arch made it too easy to download and install unverified, untested, potentially malicious software through the AUR and now every idiot that thinks they know what they’re doing are infecting their systems.
There are some software that I only have because of AUR. For example, Brother printer drivers.
AUR is a great option to have. It doesn’t mean people should use it for everything, when there’s a perfectly capable version of the same software downloadable from Arch, Flathub or even through Distrobox.
Having options is a good thing, people just need to take care.
In fact, downloading something from AUR without checking it is hardly more dangerous than adding PPAs in Ubuntu.
https://archlinux.org/about/
Versatile, sure.
But Arch is anything but simple. The proof is the number of Arch spinoffs that were made to make it easier to install and use.
And any distro cam for competent Linux users. I mean, Linus Torvalds uses Fedora. I don’t think theres a more competent user than him.