Arch Linux

UO14

Member

Registered: 2025-10-14

Posts: 26

Security stance; long term value; over-use of 'Topics goign nowhere'?

I'm really not sure where the right place to leave this is, as its not intended to open discussion honestly, but rather to leave feedback for parties whom I don't know who they are.
I consider the main value I have to offer on this matter, is that I am not in tune with or aware of whatever the Arch Zeitgeist might be.

I now know of two parties who have just decided finally to leave Arch as their daily driver because of a number of reasons but the, not so much straw, but rather lead bar, that finally broke the proverbial camels back was the handling of the AUR issue and particularly the communities general stance around it, which echoed stances on other matters which are part of the accumulating issues.

The stance on the AUR issues going back to when they first emerged can most accurately, and genuinely in terms of their effect and essence be summed up as: "if you say so, but 'security' is a 'you' problem." . Any attempt to dress it up as something else is just that.

This is thinking from the 1980's, it has no business surviving in this day and age, and it simply adds up to 'terrible' engineering, and bad technology. I am rather reminded of Linus Torvald's recent comments on another matter highlighting that his project was not intended to advance any religious dogma he might have (although I recognise that it is one of the main functions of a distro t' add its own unique flavour to Linux, and if that is zeal, then that's its business.) This matter reminds me of those comments though, and I mention this for anyone who values Arch for its technical focus.

The fact that I, as a tiny sample of experienced people, am witnessing them leave, (the leavers are experienced, not me) may not, or may, be a sign of a weakening in Arch's proposition of value in the long term.

Open Source and public domain are the bedrock of Linux, that much is true no matter the distribution. Every distribution 'needs' a 'usable' 'community' repo, every bit as much as core and  extra.

---

Tangential to this (but in my opinion echoing the Zeitgeist) I am increasingly minded to think that the 'Topics going no-where' is somewhat overused, and might on occasions be better renamed as 'Topics complex and nuanced enough to require difficult discussion'
I note that this topic https://bbs.archlinux.org/viewtopic.php?id=313924 was moved to that forum, which at the time I thought I could empathise with, and could understand when viewed 'clinically'. It seemed reasonable, but as the AUR debacle continues with no actual tangible improvement after all this time, I am inclined to now judge the side-lining and so derailing of that topic as ill-adventure. I have thought some other topics buried far too quickly also, where the pattern behind their qualification for burial has been unclear. Not everything is compatible with 'specify problem', 'test progress against that specification', but that does not mean it is not essential or otherwise optional.
That said, after my topic here has had time to be read by enough people to prod additional fresh thought on the matters above, I do see this topic as a soon candidate for 'going nowhere' . As I say it was more feedback than discussion
I suppose its also an opportunity for other people to say if they too have recently witnessed long time Arch advocates leaving because of the stance surrounding AUR and other similar gate-keepy sentiments in general. Yes, also, people come and go and come and go again and come again from distros all the time, of course.

Last edited by UO14 (2026-08-03 09:45:25)

Lone_Wolf

Administrator

From: Netherlands, Europe

Registered: 2005-10-04

Posts: 15,279

Re: Security stance; long term value; over-use of 'Topics goign nowhere'?

Nope, haven't noticed that. Did they leave a farewell message on this forum, one of the archlinux mailing lists or official IRC channels ?

Are you suggesting we need a new sub board in the /dev/null section ?

---

Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.

clean chroot building not flexible enough ?
Try clean chroot manager by graysky

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,241

Re: Security stance; long term value; over-use of 'Topics goign nowhere'?

Threads go TGN when it becomes obvious that there'll never be any resolution but rather endless bike-shedding.
This isn't punitive nor harmful to the participants, but keeps them out of search engines, shielding users from the outfall of heated comments and the general public from running into rabbit holes when trying to fix their wifi.

Every distribution 'needs' a 'usable' 'community' repo, every bit as much as core and  extra.

Why how and what does that actually mean?
Extra and Community were merged because the differentiation ended up being rather artificial.
Community was NOT dropped - neither into the AUR nor anywhere else.

The stance on the AUR issues … be summed up as: "if you say so, but 'security' is a 'you' problem." … This is thinking from the 1980's

Blindly running shell code you downloaded from a public forum (which  the AUR essentially is) where some dude posted it was wrong in the 80ies, 90ies, 2000's, teens, yesterday and will be wrong when someone asks that from the Mars station.
I understand that many people were deceived about the nature of the AUR by social media and linux influencers, but if some jerk sullying some fringe AUR package with beyond obvious malware freaks you out, the reality is and was that you must not use the AUR.

If the misconception about the AUR was the main attraction to archlinux, leaving both behind is simply the correct and sane move for you - at least for now.
This is perfectly ok and nothing to be ashamed or worried about.

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

zpg443

Member

Registered: 2016-12-03

Posts: 316

Re: Security stance; long term value; over-use of 'Topics goign nowhere'?

It takes but a few minutes to review PKGBUILDs and all of the hand-wringing seems to be overblown.

Did you think you could just treat AUR packages like official ones?

If the AUR was your primary reason for installing Arch, do you have a better alternative than Arch?

Learn how to review PKGBUILDs before installing, or take your chances. Your call.

loqs

Member

Registered: 2014-03-06

Posts: 18,996

Re: Security stance; long term value; over-use of 'Topics goign nowhere'?

The stance on the AUR issues going back to when they first emerged can most accurately, and genuinely in terms of their effect and essence be summed up as: "if you say so, but 'security' is a 'you' problem." . Any attempt to dress it up as something else is just that.

This is thinking from the 1980's, it has no business surviving in this day and age, and it simply adds up to 'terrible' engineering, and bad technology.

Please expand on what security Arch should be providing for AUR and where the resources to implement and maintain will come from and why you believe Arch should be doing that rather than maintaining official packages?  Please expand on what you mean by 1980s thinking.  What is terrible engineering and bad technology?