you are viewing a single comment's thread
view the rest of the comments
[–] 10 points 4 months ago*

Comparing the AUR to nixpkgs is like comparing the NUR and random flakes to the main Arch repositories.

Had the AUR been prefixing the package names with the maintainer name like the NUR does, then it would not be possible to do the orphan adoption attack at the same scale. (Instead a bunch of duplicates with higher version numbers would pop up, prompting users to switch)

  • source