169
The security situation with the Arch Linux AUR got a lot worse (www.gamingonlinux.com)
submitted 4 months ago by to c/linux@programming.dev
29 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 28 points 4 months ago (9 children)

The article mentions the potential need for human review. I have no idea how that could be feasible for something as massive as the AUR. Maybe it could work like Nix, where every package goes through a PR/MR process, and then after it gets approved, the submitter is added to the list of contributors. It's definitely not a perfect process, but it's better than the zero-review process that the AUR has.

  • permalink
  • fedilink
  • source
  • hideshow 9 child comments
    •
  • [–] 10 points 4 months ago (7 children)

    I've noticed some installers have at least a voting system (e.g. Octopi) which helps... slightly. At least in knowing what the right package name probably is. Crowd source reviewing is probably the only option for such a vast and open system, even if it can be gamed sometimes.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 8 points 4 months ago (1 child)

    imo, there should be automatic tags like "active", "abandoned", "maintainer changed recently", "updated after hiatus" and a few more.

    The arch devs and community can decide on the time frames. It's not going to be perfect, but it may help warn users of the changes and so they can do a double take.

    Anything other than the "active" ones should show what changed (paru already does this) and users should make a conscious choice to install it anyway. (y/N) instead of going through the installation spamming the return key.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 4 months ago* (3 children)

    It is my speculation based on experience and direct invitations to review stuff that Google effectively does ranked crowd-sourcing for Google Maps, etc., in which Google secretly tracks and gives heftier vote power to veteran accounts with longer histories of competence and reliability (especially, say, accounts that are a decade old and still regularly contributing and proposing corrections), unbeknownst to said account holders themselves. Perhaps their lead could be the way out of such messes.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 4 months ago* (2 children)

    This is kind of funny, because in the "reviews" part of Google Maps, a "Local Guide" giving a restaurant ⭐⭐⭐⭐⭐ is usually a strong indicator that you shouldn't eat from there 😉. That has been my experience, at least.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 4 months ago (1 child)

    Huh, well, I can tell you that Google classifies me as a local guide just because I try to regularly review places I go to, and I'm always honest with my reviews... I've left some scathing ones (not without reason, I hope) here and there as well 🤷🏻‍♂

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 4 months ago

    just because I try to regularly review places I go to

    That's what appears to be the problem. Quantity over some definition of quality makes it easy, and even creates the incentive, for some hustlers to go around soliciting money for positive reviews.

    Pay and your shit is marvelous, the best in town. Don't pay and you get 3/5 at best (I would presume smart hustlers don't go for 1/5 often to avoid getting too deep into blackmail territory).

  • permalink
  • fedilink
  • source
  • parent