4 ms·
Well as a lazy arch user i installed pacaur and just use official and AUR sources without much checking. It's just convenient that there's an AUR for everything
by dtx1 8y ago
Well as a lazy arch user i installed pacaur and just use official and AUR sources without much checking. It's just convenient that there's an AUR for everything
- AsyncAwait 8y agoFor packages with many votes this is somewhat fine, but you should still skim the PKGBUILD as the maintainers of even popular packages may change in time.
- ChristianBundy 8y agoI'd recommend checking both PKGBUILD and clicking "View Changes" to see who (and what) the last few authors have been up to. It's relatively common for people to be added as co-maintainers after posting even just one helpful comment (!) in an unpopular package, so it's worth double-checking to make sure a big change hasn't been made recently without the author's permission.
- michaelmrose 8y agoIf this is your means to secure your system you may be in for a rude awakening.
- matthewbauer 8y agoBe warned that malware like this is in the AUR all the time. It's so common it's not even newsworthy. They are usually pretty good at handling it though.
- voltagex_ 8y agoAny sources/articles for this?
- pierrec 8y agoI've never heard of this happening and I can't find a single occurrence of it. I mean, I agree with "don't blindly trust everything in the AUR", but this seems wrong.
- nerflad 8y agoI maintain 14 AUR packages and have also never heard of this happening.
- atomicnumber1 8y agoAlso, the aur community seems to be very active.
- michaelmrose 8y agocitation needed
- cookiecaper 8y agoThe AUR is really handy, but you do need to be careful. Arch does not pretend to hold the user's hand, and you're not likely to get much sympathy from the community if you get bitten by recklessly installing stuff from the AUR. Also, as far as I know, pacaur is no longer maintained. I switched to trizen, which prints the PKGBUILD on screen before allowing the user to opt in to executing it. Not going to pretend that I always review the PKGBUILD thoroughly, but I do generally skim them, applying more scrutiny as packages become more obscure.