> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?

That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine.

A decade of telling people that if they don't update constantly they're at risk, also affects us computer people.

Being able (and willing) to inspect source tree is the exception here, not the standard.

▲

embedding-shape 2 hours ago | parent [-]

> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine.

Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure.

AUR is a very different thing from this, where essentially anyone, at any time, can become a "mirror" and host whatever code they want, with zero review.

I obviously don't review stuff when I use pacman and official Arch package repositories, because again, those aren't "Wild west of random binaries", like the AUR.

▲

dijit an hour ago | parent | next [-]

Realistically, maintainers are strangers on the internet to me, and crucially, it is common to add unofficial repos, as well as use non-platform package managers like npm, cargo and pip.

It’s all strangers stuff

▲

DavideNL 2 hours ago | parent | prev [-]

I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…)

The latter might be a problem caused by hosting it on the archlinux.org domain: it creates a *feeling* of trust, for the uninitiated.

	▲	embedding-shape an hour ago \| parent \| next [-]
		> I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…) Yup, 100%. Probably I've spent way too long time trying to make people (in the various AUR submissions here on HN) realize that the AUR probably isn't what they think it is, as most replies/comments about the AUR seems misinformed about what it is for and how it works.
	▲	matheusmoreira 2 hours ago \| parent \| prev [-]
		> for the uninitiated Arch Linux is not for the uninitiated.