this post was submitted on 28 Feb 2024
-11 points (38.8% liked)
Linux
48186 readers
1601 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Do you look at the stuff in the aur? Because any of that stuff you install from there could be messed with because it's a user repository. I specifically left arch because I had to look into all the packages I installed from the aur, and the stuff from the official repos was pretty limited compared to something like Debian. That took a lot of time. Or, you could always just install whatever you find with zero concern about security.
I've been running Debian for decades with maybe 2 problems I had to manually resolve with apt. I ran arch and manjaro for maybe a year, and had a handful. I'm certainly not going to say not to run arch, but it's in no way easier to keep running than Debian. That's literally Debian's whole gig.
In all the years I've used the AUR I only heard of one pkg violating security, it was recognized pretty fast and was removed within hours from going up. AUR pkgs have history/track/votes on them, with thousands using them it is just as likely an official pkg having rogue code as an aur pkg.
Also, aur pkg are not really software written for the aur, it is software packaged for the arch ecosystem, and several other distros are using them.
@constantokra @pineapplelover
Right, and that's a good reason why you should feel reasonably comfortable installing very popular software from the aur, once it's been there for a while. That's not why people like the aur.
People like that you can get even unpopular stuff in the aur, and that's the stuff you need to be suspicious of. If you're getting some niche y2k era packet radio software from the aur, you should be checking how it's packaged and what is actually being packaged. And if you have the knowledge to do that you might as well get the source and install it yourself. I'll admit that i'm getting old, and I don't know if that's something people aren't willing or able to do these days.
Maybe i'm just cranky about arch, but it just seems really stupid to me to go through manually installing and setting up your system just to either install some random crap from the aur, or have to manually review it all because the official repos are pretty bare.
1 If you take an average AUR pkg and read its content (PKGBUILD) the procedure of building an arch like pkg is not very much unlike the practice of building and installing from source as in the old days. The difference is that when a new revision or need for patch, or rebuild due to fresh libraries/dependencies is necessary through your AUR helper you will be notified.
@constantokra
Yes. It is possible to verify what's going on. That's what I did when I used the aur. Do you think most people do that, or even look at see how many users are using the software? Or do you imagine they just install it blindly?
If you ever see a help video or article that suggests installing something from source, or run some script people generally tell the reader that they shouldn't just run random code without looking at it. I've never once seen anything that suggested people should check the pkgbuild. I don't have a problem with the aur. I just think it's not nearly as trustworthy as it's generally made out to be, and I don't think people generally understand that it might even be a concern, or that you can check the validity of the package yourself.
One out of five pkgs in AUR are so unmaintained they don't even build anymore.
Clieaning up junk is more urgent than screening what comes on.
@constantokra