/g/ — More malware in the AUR, this time the ALVR package.

>>109031268 (OP)
if you use the AUR or think it's good you're a retard.

How do you protect from info stealer malware? Do you just pray 2FA works on online accounts?

>>109031293
Security keys

File: 1777476064446924.jpg (362 KB, 1482x740)

>>109031268 (OP)
Usecase of AUR?
My Gnome Linux works just fine.

This is one of my concerns about Arch, I keep hearing the AUR being touted by the Arch community as a prime feature, but it seems like it's basically a Wild West frontier land where there's nearly zero oversight and basically anything goes.

>>109031408
You have to be the oversight yourself.
If you cannot parse bash scripts, you shouldn't use AUR.

>>109031408
who parses the pacman repo?

>>109031268 (OP)
Why is everything on Discord in 2026?

>>109031694
Normoids.

>>109031694
Ease of use, low barrier of entry, massive pre-existing userbase, lots of features, etc.

>>109031711
In other words, things normoids care about.

>>109031694
virgins like when they get the admin role on a platform for niggers

>>109031268 (OP)
I'm too lazy to vet everything and supply chain attacks are becoming more common. I moved off a rolling release distros after the XZ utils attack.

>>109031721
things normal people DONT experience themselves as caring about because its normalized

>>109031268 (OP)
> more malware in an unrestricted repo where anyone can upload anything at anytime

Really shocking stuff. Who would have known that you shouldn't run random executables anonymous people upload on the Internet?

>>109031268 (OP)
AUR is Arch's Achilles Heel. It just won't survive the (AI) malware attacks that are coming.

>>109031268 (OP)
>orphaned packages again
How many times again this needs to happen before AUR takes note?

>>109031404
>Usecase of AUR?
Sometimes you want something that's not in the official (yet).
For example I play the game "Factorio" and use the music service "Deezer" which have AUR packages but no official ones.

>>109032312
what makes a package orphaned? not updated in a week?

>>109031967
You have to be a "trusted user" to upload to the AUR.
Basically be part of a special club.

>>109032341
>you dont understand, i need to UPDOOOT!

>>109031268 (OP)
How retarded do you have to be to be using Arch.

https://gr.ht/aur_pkg_list.txt complete list of affected packages, there are over 400 of them.

>>109032668
They haven't even taken down the malicious package yet ffs https://www.npmjs.com/package/atomic-lockfile

File: 1711219584972692.jpg (190 KB, 700x736)

You run Arch, btw.

>>109031292
this.
my desktop is on Arch and I have never needed the AUR in all the 9 years I am using Arch.

>>109032694
but the repo is down if you check it

>>109031268 (OP)
I was wondering why this never happened before.
The archfags always told me "because it's all carefully checked!" but I know how well that works.

What a surprise.

>>109031292
Basically this.

>>109031404
"Usecase" is that the Official repos are pretty limited (Waterfox isn't in it but Firefox is; as an example) so you use AUR if you want a "repo-like" experience over compiling or using flatpak/appimage/snap instead.

>>109031292
At this point I really need to learn to compile things myself. I've been lazy to do it because I only need a few things that the official repo has already, but it's a good "skill" to know.

>>109032647
>Download from github release
or
>Follow the link for the offical website on the github page
You also get software updates as fast as the dev releases and no risk of your packager getting compromised.