(hopefully this doesn’t read as blaming the victims instead of the attackers but) I personally don’t think it’s that complicated to read the updates to AUR packages. It’s not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?
i wouldnt know where to get the info in the first place. when i use windows update i also dont reed any changelog because that shouldnt be the users job but the suppliers
As an avid user of the AUR, you’d be correct if you were downloading from the official arch repository. But you aren’t. AUR is basically like downloading from github. The only “guarantee” you get is from whoever put the package up and its up to you to determine if they’re trustworthy.
The whole point of the AUR is that it’s just random people’s code. There is no supplier here. If you don’t know where to find that information, you really shouldn’t be using AUR.
(hopefully this doesn’t read as blaming the victims instead of the attackers but) I personally don’t think it’s that complicated to read the updates to AUR packages. It’s not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?
i wouldnt know where to get the info in the first place. when i use windows update i also dont reed any changelog because that shouldnt be the users job but the suppliers
As an avid user of the AUR, you’d be correct if you were downloading from the official arch repository. But you aren’t. AUR is basically like downloading from github. The only “guarantee” you get is from whoever put the package up and its up to you to determine if they’re trustworthy.
The whole point of the AUR is that it’s just random people’s code. There is no supplier here. If you don’t know where to find that information, you really shouldn’t be using AUR.