Post #3644140

Currently having a fun little time checking my EndeavourOS system for packages that were compromised in the recent AUR malware attack. As far as I can tell, I've avoided disaster - a scan found no compromised packages and I didn't update anything during the critical period. It has gotten me a bit more wary of the Arch User Repository (AUR), however. I've always heard people say "you can't trust anything in the AUR, it's a free-for-all" - but, the pacman package manager doesn't treat it like a free-for-all. pacman lumps all the AUR stuff in with official packages with little distinction other than the AUR stuff has "extra/" at the start, and you can install those packages as easily as anything else. I think that's not pacman's fault - it's specifically designed to be that flexible, and it's doing exactly what it was told to do. I think the problem is more one of messaging and education - even with all the warnings, it never felt like using pacman was dangerous. #linux #pacman