4 ms·
While true, tarring Arch here is a little unfair. AUR isn't enabled by default. It can't even be used via the same package front end, and in fact the "officia
by ajross 5mo ago
While true, tarring Arch here is a little unfair. AUR isn't enabled by default. It can't even be used via the same package front end, and in fact the "official" usage model requires that you clone the source yourself.
Indeed, AUR is bad as a software distribution mechanism (really it's best understood as a proving ground for baby packages before they get real maintainers and distro blessing), but it's less bad than NPM which puts the malware in the trusted/default/automated path.
- Ancapistani 5mo agoI didn’t take it that way at all - rather, Arch is the only one that does it “right” with the AUR.
- nailer 5mo agoIf you want a usable system, you enable AUR. It's not 'doing it right', it's avoiding responsibility.
- antiframe 5mo agoDepends on who 'you' are. I have one package I installed from the AUR and it's from a corporation that just repackages their builds. The problem is always who vets the packages. I trust the Arch team and I trust that one corporation. Also to use the AUR it's a different command, so I can't get surprised by an AUR package. It's not a pacman -Syu is going to pull in a new unknown to me AUR package.
- Ancapistani 5mo agoIt's putting the responsibility on the party most capable and interested in evaluating the packages for security.
- matheusmoreira 5mo agoI'm not tarring Arch, I was praising it. I made sure to explicitly spell out the "User Repository". Arch is the one that does it right.