Vagueposting clickbait? On the internet!? For views and clicks!?! The website is AIDS it's so full of ads!?

To be clear, -Qm displays installed packages not currently in the repositories. This will include AUR packages, but I avoid the AUR (except for davmail years ago) every once in a while I'll run it just to check and sometimes it finds packages.

When you install things from the main repos the dependencies get installed too, and if those dependencies are no longer needed they'll be removed from the repositories. (I also have a bad habit of forgetting --asdeps when installing optional dependencies.) Sometimes they'll conflict with a new dependency and pacman will ask to remove and replace them, but other times the functionality has become a part of an existing package, so with no conflict to prompt removal they'll just sit unused on your install. If you haven't tried -Qm in a long while you'll probably find a few harmless currently-unused packages that were installed through the normal repos. (-Qdt will cover the other cases where dependencies remain in the repos but are now only needed for packages you don't have installed.)

Obviously -Qm will also show removed packages that aren't dependencies, a few years back my preferred pdf viewer was removed from the repositories.

-Qm will also find manually installed packages that aren't in the AUR if you ever do that.

Here are some scripts that can help too

(Edit: apparently i need to say to read and understand what these scripts are doing before running them. If you don't understand what you're running then don't run them) https://gist.github.com/Kidev/85756c3dcad3623ca5604a8135bafd14

I had more aur packages than I thought but none in the list. Is this just known ones and there could be more?

I remember the good ole days when nobody cared enough about Linux to spread malware to it. Sigh. All these techbros that need to j their d to their power trips, dystopian surveillance, and shitty AI companies have probably started this. I even noticed a Linux hate sub on Lemmy. Imagine there being enough people forced to use Linux to create a hate community where they favor Microslop. Such strange times we live in.

"Foreign hackers"

Foreign to who?

The article never said "foreign", you made that up.

AUR is still working as intended. It’s basically a public wiki of shell scripts, it was never intended to be secure in the first place. It has always been the user’s responsibility to review everything or avoid using it.

arch doesn't ship an aur helper pre installed. It's the derivates leeching the arch aur infrastructure and preinstalling aur helpers suggesting it's safe to use as is

I am actually enjoying most of it, yeah.

It's just a repository of user-contributed packages. It's no different malware-ability-wise to, say, GitHub. If you are running code you found from a stranger on the internet then you are liable for it, and you need to do your due diligence in checking that you are not running malware. It is a good thing that the AUR exists because it means Arch user packages are all in one centralised repository instead of scattered across GitHub, Sourceforge, Codeberg, Pastebin, forums, whatever. If you are just installing random AUR packages then that's on you. It's basic internet safety to not automatically trust random scripts you find on the internet.

Debian users should receive their news 6-12 months after everyone else, change my mind

/s

Me, a NixOS user, watching folks fighting over a bunch of legacy distros 😎😎😎

Huh, you really feel schadenfreude over another reputable project being hit by/having to deal with malware? And all the people who might be affected by it?

That is not something that would ever cross my mind.

Whoa, this is blowing up. Chill, guys. I really think that sucks. If anything, with Arch being bleeding edge and all of that, at least you're showing early the tough wake up the other distros will have to do in relation to malware after Linux' increasing popularity. Time to brush those SELinux and apparmor bits, even.

But, now, we Debian users are okay, (btw, 😎).

Nothing says "socialist vibes" like gloating over other Linux users

I use arch btw, it's only effecting the arch user repository, which lives separately from the maintained repositories, it's not even possible to download stuff from there with pacman. Really it's just a community space, I also have packages there. You can download pre-packaged apps, so if you install them, you will be able to remove them with pacman. I think it's a great concept.

it's like a forum where some jerk writes "use 'sudo rm -rf /' to speed up the computer". Except you don't have to read it to execute their plan.

Flathub is also concerning btw. But at least those apps are containers (with too much permissions)

Some of this can be alleviated by not using the latest version of everything. Granted that's not always possible, say if updating to fix a vulnerability or bug fix. Stable distros will have some insulation from this at least since there will be more time to discover the issue.

That's a failed analogy. The AUR is an end-user build-script repo, not a source/binary/source+binary repo for both devs and sometimes users.

If you e.g. install a CLI tool via cargo, there is at least an implicit tree of trust, with each dependant in a dependency tree doing at least some minimal vetting of dependencies. And the source is all there anyway (barring exceptions like build.rs pulling code, or the indirection of proc macros).

The same applies to npm and pypi, although there is no distinction between "code" and "binary", given the scripting nature of the languages. But some pypi packages do actually distribute binaries (e.g. C/C++ compiled libraries). Don't know about npm.

But, if I'm not mistaken, the py/js tooling wasn't always there for stuff like full pinning of dep versions like cargo, and that's a very important technical detail.

With the AUR, there is no trust tree. And often no fixed code (or binaries) to look at (e.g. *-git packages). So the feasibility of doing any sort of global in-tree checking/vetting is not there. On the other hand, source repos are responsible for removing, or at least flagging, malware or otherwise harmful packages once that becomes known.

Incidentally, I commented on both AUR security and cargo trust here and here. So, I will stop blabbing.

I've noticed some installers have at least a voting system (e.g. Octopi) which helps... slightly. At least in knowing what the right package name probably is. Crowd source reviewing is probably the only option for such a vast and open system, even if it can be gamed sometimes.

No, the entire point of AUR is to be a repository of unreviewed publicly submitted scripts. Malware has always been an expectation. If you don’t want that risk, don’t use AUR.

I have 1825 packages installed, 15 of which are from the AUR, and I use for very specific stuff, like VR. I personally know the mantainer of two of them. The AUR is cool, but should always be used with the same care as manual downloads.

Top 10%? Why not just top 10 most used? Or top 25? Maybe top 25 accounts for 80% of AUR traffic

It seems like some person with a bot just asked to maintain a bunch of orphaned packages, abusing the 2-week waiting period. Right?

Thats why they used npm; off the shelf, almost “standard practice” credential harvesting malware. Nothing too fancy.

What about Aura https://aur.archlinux.org/packages/aura

Nah, just curl the install script from GitHub pipe it to bash, make sure to run it with sudo.