Didn’t Arch just have a major security issue due to their packages essentially being random guys too? (And I think the same thing could theoretically happen to most distributions?)
To add to that, the wiki also makes it pretty clear users should be careful. It’s nice to have for packages that aren’t in the main repos, so it makes sense to have it somewhat part of the distro, but it does take manual effort to install aur packages, so in my mind, that’s the best way to do it.
No. Their “here’s also this unofficial repository of builds completely maintained by random community users… USE AT YOUR OWN RISK - You have been warned!” ArchUserRepository got the least used (often long abandoned) packages hijacked by some bad actors.
But “Less than 1% of the least used packages in the unofficial repository you were explicitly warned about got hijacked by people trying to infect oyur PC” would not have been an interesting headline gathering attention.
Didn’t Arch just have a major security issue due to their packages essentially being random guys too? (And I think the same thing could theoretically happen to most distributions?)
No, that was AUR. Those were user-generated packages with nearly no vetting.
Ah gotcha, that is different indeed!
To add to that, the wiki also makes it pretty clear users should be careful. It’s nice to have for packages that aren’t in the main repos, so it makes sense to have it somewhat part of the distro, but it does take manual effort to install aur packages, so in my mind, that’s the best way to do it.
Big red label at the top: https://wiki.archlinux.org/title/Arch_User_Repository
Windows users are out there downloading random exe files…
No. Their “here’s also this unofficial repository of builds completely maintained by random community users… USE AT YOUR OWN RISK - You have been warned!” ArchUserRepository got the least used (often long abandoned) packages hijacked by some bad actors.
But “Less than 1% of the least used packages in the unofficial repository you were explicitly warned about got hijacked by people trying to infect oyur PC” would not have been an interesting headline gathering attention.
Ah, gotcha! Well, if it’s any consolation, clearly I didn’t click on the clickbaity headline to read the actual low-quality article :P