2025-07-18 18:57 UTC
@gromit@chaos.social @froge@social.glitched.systems @archlinux@fosstodon.org is their an explanation for dumb people like me, why it is more unlikely that something like that will happen in the official packages or even in the debian repository. like a package maintainer goes rogue?
Replies (1)
-
@froge@social.glitched.systems 2025-07-18 19:00
@utf_7@mastodon.social @gromit@chaos.social @archlinux@fosstodon.org the official repos are managed by trusted maintainers and have a review and quality assurance process which is likely to catch any malicious or incorrect changes the AUR is simply a list of packages maintained by random people who have free reign to update them whenever they want, with anything they want, without review or checks using the AUR is a bit like going and installing a random binary from a random github project, without anyone checking the code at all, the official repos have a lot of peer review by people with good reputations in the arch community