Obviously installing anything from AUR must be done cautiously and there have always been sketchy (as in improperly built/packaged) packages in the past but seeing actively malicious injections is concerning. I think there are two main problems with AUR: 1. it is a remnant of a slightly more egalitarian era in the open source history when you could generally trust 3rd party code and 2. orphaned packages can be adopted by anyone with their full history and vetting intact.

I think we are well past (1) but (2) could be mitigated by tighter controls on AUR accounts and potentially additional safeguards from AUR helpers. Maybe show a big scary warning if the package has changed owners recently. I know there will still be people that will "y" their way forward but it's better than nothing.

Or just avoid AUR helpers altogether and inspect/build the packages you need yourself from their PKGBUILDs directly.

▲

jeremyjh 4 hours ago | parent [-]

There was never an era in which #2 was a reasonable policy.

▲

akdev1l 4 hours ago | parent [-]

The canonical answer to any concerns with the AUR is always “just read the PKGBUILDs bro”

▲

hootz 3 hours ago | parent [-]

For every single update, for all your AUR packages, all the time.

You know that thing where if you make a security review feature obnoxious, after some time people will just accept everything without even looking? Yeah...

▲

ptx 11 minutes ago | parent | next [-]

> For every single update, for all your AUR packages, all the time.

Yes, that's what I used to do when I ran Arch. It's usually easy. The PKGBUILD is usually small to begin with and the difference for a new version should normally be something like the URL and the version number and not much else, so you can just diff it against the old version.

▲

rossvor 2 hours ago | parent | prev [-]

You are thinking of the alarm fatigue[1], but it doesn't apply here -- there are no constant alerts warning that you are doing something dangerous to the point you get desensitized and start to ignore them. The correct analogy here are checklists -- things that you need to check if you are to do this "dangerous" activity (AUR usage), akin to pre-flight checklist.

[1] https://en.wikipedia.org/wiki/Alarm_fatigue

▲

hootz 2 hours ago | parent [-]

Oh yeah, that's the name of it. But I guess something similar happens with checklists, you do it so many times without anything bad ever appearing that you start to subconsciously assume nothing will ever happen. Why check the rotor of my helicopter when nothing ever happened to it for 5 years? This checklist is a waste of time!

	▲	opan 2 hours ago \| parent [-]
		That one's survivorship bias I think.