My security best practice of forgetting to update for several months in a row finally pays off.
TBH it should be a configurable option on every update tool. On my windows install I have unigetui set to only show updates older than 14 days so winget, pip, etc don’t even show brand new updates.
You jest but it’s a thing https://cooldowns.dev/
Note that AUR is generally untrusted, and is not an part of the Arch distro (but included in some derivatives). Arch users always were and are warned not to install packages from it without proper inspection. [Added: And adequate inspection just did become very hard!]
I think AUR is great for trying out things and sharing with people you know personally - and not much more.
For installing or distributing established, trusted software that is not part of the Arch distribution, I think Guix is better (which runs fine as an extra package manager in Arch, and has currently 31,000 packages, in spite of that it is relatively young).
But the general thing is one just cannot run untrusted, unverified code. Regardless from where - regardless whether it is AUR or pip or Anaconda or MELPA or Guix or crates.io . In terms of computing, it is like giving a stranger on the street the keys to your house.
Having a competent community reviewing software before it becomes part of a distro is what makes using Linux relatively safe (but not foolproof).
+1 Guix
Is thr solution truly to tell people to read the build instructions and decide if a package is safe? I’m not an arch user, but I’ve used nixos and assessing nixpkg before installation gets old real quick real fast. Somehow I really doubt telling an average user to assessing pkgbuild on their own will be very effective.
Somehow I really doubt telling an average user to assessing pkgbuild on their own
Arch Linux is not really made for the average user, and using code from AUR even less so. I doubt it that everyone using Arch+AUR or CachyOS or youname it is served well by this.
And making it kind of accepted norm to run untrusted code as a non-technical user will bite the Arch community in the ass. For Arch, it is a phony measure of success to have many such users.
This is also a result of Windows user attitudes leaking into the Linux universe. You need to discern code and data, and you can’t run untrusted code, period.
flathub stays winning?
“But it’s 100 MB larger than its AUR equivalent! That means bloat!!” Arch users probably
it is bloat. also were is your package for (insert any very obscure program). I guess your going to have to rely on appimages or building from source for this one!
Bloat implies the extra space is unused or without utility. The extra bytes in Flathub packages usually come from containerization, which adds a layer of protection for the user and makes apps interoperable across all OSes. It’s also funny that you’re calling those extra bytes bloat in a post where AUR users would have benefited from the containerized design.
Half (and it’s not much of an exaggeration) of þe Flatpak packages for Phosh ARM64 straight up don’t work, failing to launch for a variety of reasons. Trying to inspect what’s going on is an exercise in frustration. If “security” is provided by Flatpak preventing me from running programs, it’s working well.
