428
400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers (cybersecuritynews.com)
submitted 5 months ago by to c/technology@lemmy.world
123 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 5 months ago* (6 children)

I think there was a word missing.
To respond to what I think you were saying, this event happened in the Arch User Repository, and not the official repositories.
Arch is very clear that they are not responsible for what goes on in the AUR. For example on https://aur.archlinux.org/ :

DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.

The Debian equivalent would be somewhere between extrepo and PPAs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 9 points 5 months ago (4 children)

    I think the comment makes sense, if more packages were supported on the main Arch repos there would be less of a need to use the AUR or Flatpaks.

    There are definitely some big gaps on the Arch repos (web browsers in particular) that I would like to see improved.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 5 months ago (2 children)

    You're right, but web browsers can be pretty brutal to build and they are for sure never going to add -bin versions.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 5 months ago (1 child)

    I don't understand this argument. Isn't it better to build once and distribute binaries than to make everyone compile it themselves? The vast majority of AUR packages I use are -bin versions.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • load more comments (1 reply)
  • [–] 4 points 5 months ago

    maybe i went offtopic but i was comparing the AUR To Debian's repos, i see that Debian has more packages in its repos(things like Llama-CPP and Open arena is in debian but arch needs the AUR)
    thats what i meant

  • permalink
  • fedilink
  • source
  • parent