Is thr solution truly to tell people to read the build instructions and decide if a package is safe? I’m not an arch user, but I’ve used nixos and assessing nixpkg before installation gets old real quick real fast. Somehow I really doubt telling an average user to assessing pkgbuild on their own will be very effective.
It is a different situation, because Nix packages are part of the Nix distributdis, while AUR packages are not part of Arch. AUR packages are more like Ubuntu ppa’s, you can add and run them, but you are on your own risk.
Also,it is a huge number of packages (about 114,000) which are many used by relatively few people. Each arch user has in average probably only a few of these.
So, it makes sense that users review them by themselves. If you can’t do that, you should probably not use them.
Somehow I really doubt telling an average user to assessing pkgbuild on their own
Arch Linux is not really made for the average user, and using code from AUR even less so. I doubt it that everyone using Arch+AUR or CachyOS or youname it is served well by this.
And making it kind of accepted norm to run untrusted code as a non-technical user will bite the Arch community in the ass. For Arch, it is a phony measure of success to have many such users.
This is also a result of Windows user attitudes leaking into the Linux universe. You need to discern code and data, and you can’t run untrusted code, period.
Is thr solution truly to tell people to read the build instructions and decide if a package is safe? I’m not an arch user, but I’ve used nixos and assessing nixpkg before installation gets old real quick real fast. Somehow I really doubt telling an average user to assessing pkgbuild on their own will be very effective.
It is a different situation, because Nix packages are part of the Nix distributdis, while AUR packages are not part of Arch. AUR packages are more like Ubuntu ppa’s, you can add and run them, but you are on your own risk.
Also,it is a huge number of packages (about 114,000) which are many used by relatively few people. Each arch user has in average probably only a few of these.
So, it makes sense that users review them by themselves. If you can’t do that, you should probably not use them.
Arch Linux is not really made for the average user, and using code from AUR even less so. I doubt it that everyone using Arch+AUR or CachyOS or youname it is served well by this.
And making it kind of accepted norm to run untrusted code as a non-technical user will bite the Arch community in the ass. For Arch, it is a phony measure of success to have many such users.
This is also a result of Windows user attitudes leaking into the Linux universe. You need to discern code and data, and you can’t run untrusted code, period.