TranscriptImage of a man pointing a gun at his own foot.

Caption: Installing an AUR package without reading it's PKGBUILD.

you are viewing a single comment's thread
view the rest of the comments
[–] 127 points 2 months ago (14 children)
  • [–] 27 points 2 months ago (7 children)

    If you want a bunch of stuff that's not in core or extra and you don't want to intensely babysit the AUR, you could try Chaotic-AUR. It hosts prebuilt packages for a bunch of AUR packages which are actively maintained by the Chaotic team.

    I consider it to be more secure than the AUR proper since they actually care for their packages and review nontrivial changes. For instance, the recent takeover attacks didn't hit Chaotic-AUR builds since the changed packages didn't make it past the review.

    It's still an unofficial third-party repository and closer to the AUR than to extra but I consider it a major step up.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 13 points 2 months ago (5 children)

    Yes, but is it good, neutral, or evil?

  • source
  • parent
  • hideshow 5 child comments
  • [–] 16 points 2 months ago* (4 children)

    I mean how often do you install AUR packages? Usually takes like a minute or so to skim through PKGbuild and the pkg comments and look for obvious issues. And most updates are just a sha hash and version change, taking like 5s to check.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 2 months ago

    Rarely, to be sure. I tried Arch for a bit, but I need a computer that I can actually use to get shit done, that isn't a constant project itself. Even Qubes doesn't require as much effort to keep operational.

  • source
  • parent