Transcript
Image of a man pointing a gun at his own foot.
Caption: Installing an AUR package without reading it’s PKGBUILD.
If it’s endorsed by the project team I might as well. At that point it’s the same as downloading from GitHub and if I am in AUR I’ve probably not found it in standard repos nor flathub.
I use Arch without touching this AUR in my latest install. Just use what’s in the main package repos or flathub
I use arch just to be able to use AUR lol
I just don’t understand the process of I don’t have two minutes to read what I’m installing. It’s fucking batshit crazy that all these retards want to come use Linux which is fine but then when they get solid advice they tell us they can’t be bothered.
Yeah, when something isn’t in the official repos, NixOS exists, Flatpak exists, and they’re all vetted.
Wanting a super clean system where everything is managed by pacman is purely about taste, so if you want it, you clearly can be bothered to put in the 2 minutes of work.
I was contemplating moving to NixOS, but then another fiasco just happened, masse me question what would one have to lose by switching to Qubes instead, considering the increasingly surveiling internet.
its
My dumb ass
What about your mute donkey?
I once found a Rust program that streamlined the PKGBUILD reviewing process a lot by, first of all, giving you a really neat list of patterns and behaviours that would make a PKGBUILD suspicios or even plain dangerous, then having a scriptable rule-based engine that would either abort that operation, or show warns and workarounds to you.
I forgot its name, unfortunately, and I installed it on my previous installation (Garuda, now I’m on CachyOS).
Very dumb of my part not to try to write that down before the OS change lol.
pkgwatch maybe?
Nah, if you really want to live on the bleeding edge you gotta make blindly installing vibecoded junk from shady parts of the AUR part of your workflow
All pointing with fingers to AUR, but the issue was (yet again) with NPM.
Sorry I missed something, how so?
The compromised packages load a script from thr net that runs a compromised npm package (“atomic-lockfile” 1.4.2).
Ok, also a AUR issue. But more so a NPM one, since they have all full moon two supply-chain attacks.
Update your desktop only all one or two weeks, get basic protection (adblocker, hosts file), read the news.
It’s a peaceful life.
Without reading its PKGBUILDfixed it for you. The AUR is toast, we have to say goodbye to it now.without reading [it is] pkgbuild
I didn’t know it was.
AUR Arch UrGettingMalware Repository
STABLE IS FOR HORSES I LOVE GAMBLING
/s
Well earned upvote, sir/ma’am.
I wish I could give you a second upvote, that’s hilarious 😂
just use nix instead
we have super secure mechanisms in place to prevent supply chain attacks
/s (nix just hasn’t been targeted yet (as far as we know 💀💀))
/s (nix just hasn’t been targeted yet (as far as we know 💀💀))
Isn’t the real security through obscurity just being such a fringe market no one bothers? 🤔
I knew there was another reason I love Carbs Linux.
Yeah, I just update all 20 flakes that I sourced from github and pray that none of them were hacked
just use nix instead
Maslow, is this your hammer?
Someone put my WM on the AUR. I am thus proud to be authoring malware :)
