Hacker News Reader

Comment by dijit | Hacker News Reader

> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?

That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine.

A decade of telling people that if they don't update constantly they're at risk, also affects us computer people.

Being able (and willing) to inspect source tree is the exception here, not the standard.

View on HN

> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine.

Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure.

AUR is a very different thing from this, where essentially anyone, at any time, can become a "mirror" and host whatever code they want, with zero review.

I obviously don't review stuff when I use pacman and official Arch package repositories, because again, those aren't "Wild west of random binaries", like the AUR.

Realistically, maintainers are strangers on the internet to me, and crucially, it is common to add unofficial repos, as well as use non-platform package managers like npm, cargo and pip.

It’s all strangers stuff

Personally, "strangers under a banner of long-standing organization XYZ" is different to me than "jkb_25342" on GitHub with one repository, with no source and only binary releases. Realistically, of course you're right, I don't know everyone who maintain the software I work, but I am familiar with the organization. Basically, you need to figure out where you can place your trust, which again for me personally, depends on a lot more things than "met face to face and know who they are".

I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…)

The latter might be a problem caused by hosting it on the archlinux.org domain: it creates a *feeling* of trust, for the uninitiated.

> I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…)

Yup, 100%. Probably I've spent way too long time trying to make people (in the various AUR submissions here on HN) realize that the AUR probably isn't what they think it is, as most replies/comments about the AUR seems misinformed about what it is for and how it works.

> for the uninitiated

Arch Linux is not for the uninitiated.

Reply on news.ycombinator.com