241
Arch Linux AUR Malware Campaign Hits Multiple User-Contributed Packages (linuxiac.com)
submitted 3 months ago by to c/linux@programming.dev
71 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 14 points 3 months ago (4 children)

Hilarious that it's JavaScript again, truely npm, pypi and cargo are obvious targets. Also, guys, minimise your usage of the AUR! I don't use any AUR packages.

Core > Extra > flathub >>>>>>>>>>>>> AUR

Not that core/extra/flathub can't be pwned but it's harder then the AUR.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 2 points 3 months ago (1 child)

    I'm interested why flathub > AUR? I try to minimize AUR usage but always assumed it's better than flathub?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 3 months ago

    Not the one you asked, but it's a case of priorities:

    • If you want it to just work, then the AUR is probably the better pick. Don't get me wrong, through; most flatpaks should (mostly) work like how you'd expect them to behave natively.
    • But, (Op)Sec-wise, the verified flatpaks win. No contest. Simply, because there's no third party involved in the process. (And I haven't even gone over flatpaks' superior sandboxing.)
  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 3 months ago (1 child)

    But mpv-git has some advantages... and edir, bat, rdo still not in the main repos.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 3 months ago

    Minimizing AUR usage doesn't necessarily mean not using it at all, but I would weigh those advantages carefully against the risk it brings. I would also recommend the people who don't know what they are doing to not use it at all.

  • permalink
  • fedilink
  • source
  • parent