Kerala Linux Community

47 readers

1 users here now

A community for Kerala Linux Users 🐧 Ask questions, share setups, and help each other.

founded 3 months ago

MODERATORS

Crumpled6273@lemmy.ca

Arch Linux: The AUR malicious packages incident continues to happen (www.xda-developers.com)

submitted 3 weeks ago by Crumpled6273@lemmy.ca to c/keralalinux@lemmy.ca

7 comments fedilink hide all child comments

CachyOS provides many packages that are not available in the official Arch repo. But no matter what, I still prefer vanilla arch over anything else... What about you?

you are viewing a single comment's thread
view the rest of the comments

[–] Crumpled6273@lemmy.ca 2 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

Debian/Arch official repos fetch software directly from the distro maintainers, while AUR packages can be uploaded by anyone. So theoretically, Debian/Arch repos are considered more secure than AUR packages. Even Flatpaks are also more secure than AUR packages.

[–] Dadifer@lemmy.world 2 points 2 weeks ago (1 children)

How can previously installed AUR packages be compromised, though?

[–] Crumpled6273@lemmy.ca 1 points 2 weeks ago

When the upstream URL gets updated with the malicious uploaders new URL. There is no warning shown in the process; the only way to check it is to inspect the PKGBUILD manually.