this post was submitted on 22 Jun 2026
41 points (100.0% liked)

Linux

14189 readers
547 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 3 years ago
MODERATORS
Ategon@programming.dev
anzo@programming.dev
dwraf_of_ignorance@programming.dev
41
AURpocalypse now: a look at the recent AUR attacks (lwn.net)
submitted 1 week ago by cm0002@lemy.lol to c/linux@programming.dev
23 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] stuner@lemmy.world 13 points 1 week ago (1 children)

It really should be shut down for Arch’s sake.

I think it should really be split into two parts:

  1. The more widely used packages should be moved to an official repository with review procedures. Perhaps the (quality) requirements can be lower, but these must be reviewed by trusted people.
  2. The remaining packages should be moved to user namespaces, like the other user-package repos do. That will at least prevent (most) takeover attacks.
[–] ZombieCyborgFromOuterSpace@piefed.ca 1 points 1 week ago

@jpv2390@discuss.tchncs.de just below your comment, quoted the Arch wiki on the original purpose of the AUR.

The AUR was created to organize and share new packages from the community and to help expedite popular packages’ inclusion into the extra repository.

Source

Thanks @jpv2390@discuss.tchncs.de