100%
But this is the problem. It's like if Microsoft provided Windows with Limewire as a solution to download software. There's bound to be people who are going to exploit it for malicious reasons, and there's bound to be idiots who are going to fall for it. Heck, there's the possibility that even someone who knows what they're doing might also get caught at some point.
It's dangerous and irresponsible.
No, it just happened to be my instance.
As a side note, for some reason, I can't see any comments inside any post on this community. That's why I have to reply though my lemmy.ca alternate account.
In control of installing malware?
I get what you mean, but people are stupid. There needs to be guardrails to prevent these things from happening. That's why the AUR is a bad idea and it should be shut down.
You want your software to be available for a distro? Go through the proper channels. Submit it for review and get it approved. If you stop maintaining it, they remove it. Plain and simple.
That's why you don't have this problem with other distros. Arch made it too easy to download and install unverified, untested, potentially malicious software through the AUR and now every idiot that thinks they know what they're doing are infecting their systems.
LOL not with Carney at the helm. He's practically selling them Canada wholesale.
I've been a Linux user for 26 years. I made distros for hardware manufacturers. I know very well the distinctions between the AUR and the regular Arch repos and the parallel with Debian's.
With Arch, the problem is that the AUR is available in the first place and is very easy to enable. People, especially new users, won't necessarily understand what they're getting into when enabling it and getting packages from there. A lot of the advice people get online suggest to get packages from AUR. So Arch users are bound to use it at some point.
And if you add to that the fact that the standard repo has bleeding edge package versions with minimal testing means that vulnerabilities can also get introduced. And it's happened before. This affected Arch, OpenSUSE Tumbleweed, Fedora, but you know what distribution wasn't affected? Debian stable and Ubuntu LTS.
And on top of that, I'm not even going to mention how unstable it is and how even just making updates is risky on Arch. You have to be on your toes all the time and you can end up with a broken system at any time. For a main PC operating system, I find that absolutely unacceptable. At least Manjaro tried to improve on this.
Valve switching to Arch makes sense though. They moved to Arch because they wanted the most up to date software and drivers available with a faster release cycle. Then control what versions they push to their devices. They keep a tight control over what gets updated by curating their own repositories. So it's not purely Arch either. It's Arch-based. You can expect software to be a little older on Steam OS.
In any case. For me, Debian is the solution. I'm looking for stability and security. It has a huge repo with practically every software under the sun. There's tons of documentation and support and a huge community. For me the distribution works OOTB without any hitch. I just know that I won't spend time troubleshooting something on my time off. I already do a lot of this during work.
Being behind a few releases isn't that bad, honestly. At least you're certain it's going to be well tested and the majority of problems have been ironed out. And there'll be documentation already on how to fix things or work around certain missing features if that ever occurs. It's much less of a hassle.
LOL! I'm not THAT old hahahahaha!
But that sounds about right. I work in IT and troubleshoot IT problems all day. The last thing I want to do is troubleshoot my PC when I get home. I just want an OS that works. Debian is the best in that regards.
Why shivers ?
It's stable, it has a HUGE software repo (one of the largest ones if I'm not mistaken), third party software and drivers are almost always available as a Debian package, the community behind it is actually serious about making it safe and problem free. So what if some of the software is not bleeding edge? At least I can rest easy when I'm updating my system. I'll almost never have any bad surprises like you get in Arch.
Arch just takes whatever the latest software is and throws it in the repos for the users to figure out if it breaks. Half the solutions you find in the wiki are half-baked solutions just to make things work, but are often not standard or even secure, leaving your system with security holes.
Not even. The PPAs are created and hosted by very specific maintainers with very specific packages. So you have someone to blame and a single software to clean up if things go wrong. And word spreads fast. Yes, there's a risk, but you can sort of judge how big of a risk it is.
Meanwhile with AUR, it's just a giant repo in which anybody can just dump whatever. The risks are huge. If I were on Arch, I wouldn't touch it for anything. I'd rather compile the source code myself for any software I need instead of getting it there.
There hasn't been a single reported incident so far. So, as far as we know... No. They aren't infected.
And I trust the community of elders that take care of the Debian distro. They have been reliable and solid. They don't just throw anything at the users on Stable. Even Testing is considered safer than most distributions.
Versatile, sure.
But Arch is anything but simple. The proof is the number of Arch spinoffs that were made to make it easier to install and use.
And any distro cam for competent Linux users. I mean, Linus Torvalds uses Fedora. I don't think theres a more competent user than him.