Taken the plunge

[Kresimir]

@Benedict

Chaotic AUR

That’s a bad idea, in my opinion. Of course, it’s your system, you’re free to do whatever you want with it, but I would urge you to get a good understanding of what is going on with packages on Arch, lest you happen to become a victim of malware due to ignorance or negligence.

A good article to read:

[FAQ] The dangers of using 3rd party repos

This is something I wrote last year and posted somewhere else. I thought it was worth sharing here as I see a lot of people using 3rd party repos. There are often discussions about the dangers of using AUR but it seems like there a lot less focus is on the dangers of using 3rd party repos. In general, using a 3rd party repo is much more dangerous than using AUR. With an AUR package, everything is fully transparent and the package is built on your machines. A quick look at the PKGBUILD file wi…

A hypothetical scenario illustrating the dangers of the Chaotic-AUR:

Current Best Practice Flatpack or Aur?

That’s a bad idea, in my opinion. chaotic-aur automates the building of AUR packages. This is bad, because of the absence of human oversight, something AUR was never designed for. If I were a malicious person, this is how I would attempt to spread my malware: I would gather some statistics on when chaotic-aur builds packages from the AUR. I would try to take over a reasonably popular package on the AUR (something that’s been orphaned), and upload a malicious PKGBUILD to the AUR just before i…

---

@fbodymechanic

Interesting about Chaotic. What was missing from the AUR that you need from Chaotic,??

Nothing is missing from the AUR that is in Chaotic. The only benefit Chaotic brings is not having to build the packages yourself locally, because the build process is automated on some server. The packages are sourced from the AUR – at least in theory, they are the same PKGBUILDS. The problem with the automated build process is that it is, well, automatic, meaning it lacks human oversight making it susceptible to abuse by malicious actors. Those malicious actors could be the maintainers of the repo, but, given how Chaotic works, it is far more likely that it would be some random person online, since anyone can upload PKGBUILDS to the AUR.

Using the AUR without understanding Arch Linux Package Management and how makepkg works is a huge liability in itself. Combine that with a 3^rd party repo that is fully automated, and you’ve got a disaster just waiting to happen.