10
Arch Linux: The AUR malicious packages incident continues to happen (www.xda-developers.com)
submitted 1 month ago by [M] to c/keralalinux@lemmy.ca
7 comments fedilink hide all child comments
 

CachyOS provides many packages that are not available in the official Arch repo. But no matter what, I still prefer vanilla arch over anything else... What about you?

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 month ago (4 children)

So what, can we trust the debian repo? Where do we get software from?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] [S] 4 points 1 month ago* (2 children)

    Debian/Arch official repos fetch software directly from the distro maintainers, while AUR packages can be uploaded by anyone. So theoretically, Debian/Arch repos are considered more secure than AUR packages. Even Flatpaks are also more secure than AUR packages.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 month ago*

    The Debian repo, yeah. Generally.

    AUR is particularly risky because anyone can submit software.

    But if you heavily rely on 3rd party Debian repos, check out the maintainers, as their security isn’t necessarily on par with the official repo.

    …And I can help but think that tons of users do this on Debian/Fedora for non FOSS packages, like Nvidia drivers, certain parts of ffmpeg and such.

  • permalink
  • fedilink
  • source
  • parent