KssioAug

For me is it’s awesome, out of the box, syntax highlighting, auto-suggestions/auto-complete and the up arrow history function (that includes substrings).

Maybe I have misunderstood what the point of the article is but… What a giant load of horse shit.

If anything it just proves that the CENTRALIZED social network is the problem. X/Twitter amplifies what Musk wants and since it’s so big and influential (also because of Musk’s financial situation) it contaminates the perception of reality in all other mainstream social media.

I fail to see how this is an example that decentralized social networks such as the ones from Fediverse could make things worse.

I didn’t.

Saying that Debian and Fedora don’t need an AUR because vendors provide packages, implying these distros are pratically immune to third-party malware is totally false. Fedora has COPR, openSUSE has OBS, and Ubuntu/Debian rely heavily on PPAs and random deb downloads from websites. See xz-utils: https://en.wikipedia.org/wiki/XZ_Utils_backdoor

Most FOSS developers do NOT have the time or infrastructure to package for every distro. They provide source code on GitHub. The AUR exists to translate that source (or a vendor’s deb) into a native Arch package. Furthermore, downloading a random deb from a vendor’s obscure website and installing it with dpkg (which runs pre-install scripts as root) is arguably less safe than a PKGBUILD that downloads the exact same binary from the vendor’s official mirror, unpacks it, and lets you read exactly what it does before you run it.

Your conception of PPAs is riddled of misconceptions. Absolutely anyone can create a PPA. Canonical does not verify the identity of the uploader beyond email confirmation. Launchpad is flooded with unofficial, community-maintained PPAs that are no more “official” than an AUR maintainer.

Also, Ubuntu does NOT proactively audit the source code or binaries inside PPAs. They takes a PPA down after it has been reported and confirmed malicious, exactly the same as the Arch maintainers do with the AUR.

A PKGBUILD is a plain-text shell script. You can read the exact source URL, the compilation flags, and the install commands. A PPA provides a pre-compiled binary file. You have pretty much zero idea what is inside that binary. Blindly giving sudo access to a binary PPA is objectively more dangerous than auditing a 20-line bash script that compiles source code before running.

Hahahahaha they also come in Debian .deb and Fedora .rpm packages. That’s why I never got this problem with my hardware on Ubuntu or Debian.

That is exactly why the AUR exists. To repackage that vendor’s .deb into something Arch can safely manage. This makes Arch support to 3rd party apps almost unbeatable.

And you’re right: PPAs are not the same… in this regard they’re actually worse. AUR is at least in plain text and the documentation is clear: always check the PKGBUILD. When you add PPAs you’re blindly trusting a 3rd party repository and updating them with sudo.

You can’t burn the whole thing down just because, in your own words, “people are stupid”. They either read the documentation and follow the security policies, or they stick with Arch and Flathub. Or, they can simply choose a different distro. It’s that simple.

The thing is, I agree that AUR could have some sort of protection, such as a rate-limiting or a reputation system. But even as is, AUR is still an excellent feature that should definitely be maintained. And people, specially using Linux, definitely should educate themselves instead of exclusively rely on strangers for all their digital security.

Edited for extra clarification.

There are some software that I only have because of AUR. For example, Brother printer drivers.

AUR is a great option to have. It doesn’t mean people should use it for everything, when there’s a perfectly capable version of the same software downloadable from Arch, Flathub or even through Distrobox.

Having options is a good thing, people just need to take care.

In fact, downloading something from AUR without checking it is hardly more dangerous than adding PPAs in Ubuntu.

The entire philosophy of Arch is to put user in control. The PKGBUILD format is plain-text and reviewable. The documented best practice has always been to read the PKGBUILD and the .install files before building.

I’m not saying they shouldn’t look into measures to make it less prone to such attacks, but “take it down” is a very stupid take. If people can’t deal with the existence of AUR, there’s plenty of different distros to choose already.