Fine agree with all of what you say. But still the AUR is the only repo where this happens majority of the times. So what to do next? I am sure the solutions I mentioned in a comment below are not that difficult to implement.

And what do you need so many packages for?

Zen Browser, Elecwhat (Whatsapp – which is recommended in Arch Wiki), Razer peripherals drivers, heroic games launcher.

Without the AUR Arch becomes a third world country distro because the official repos have only the basics.

I am not talking about the code. I am talking there are basically zero security measures.

Edit:

Demanding to do more work from volunteers which already do a lot of work for free is rude. If you want something done - do it yourself

Then don’t make the platforms in the first place. This is such a stupid argument. It’s like someone creating a nuke but then ignoring the security measures and telling the rest of the people to take care of it. Genius. Should stop asking people to switch over to Linux as well then. Might as well I should just start bad mouthing and defaming Linux because users are left on their own by a hostile community.

That’s why we have warnings plastered all over.

Plastering warning labels everywhere is a cheap way to shift 100% of the accountability onto the user. Security should be built into the AUR’s design (throttling new accounts, forcing forks for orphaned takeovers or maintainer-developer verification), not outsource your job to the users as a reading assignment before every system update. Humans are the final layer of defense not the first.

Or maybe don’t use AUR blindly? You’re doing the equivalent of sudo curl — | bash… So only do it if you truly trust it.

There is a massive difference between blindly curling a random script from the open web and using a centralized, organized community repository. Yes AUR helpers are not recommended but they exist and are used by majority of Arch users and you can’t expect the user to know code and pkgbuilds especially when distros like CachyOS make it so damn easy to install the OS with AUR being just a checkbox away.

Just don’t run random code that you don’t understand

I don’t understand any code so does that mean I shouldn’t use any software? that is 99% of the world.

whole purpose of AUR, users can create and share packages with minimum fuss

This doesn’t take away responsibility away from the Arch team. I can manually review pkgbuilds all day trying to understand no problem but expecting the user to do it every update is stupid. At some point the user will just start to trust that package maintainer. I already mentioned few steps that the Arch team can take in a comment below.

I am gonna get a lot of hate for this but the AUR flaws are hidden behind a legal warning of “At your own risk”. They just don’t want to take the legal consequences for this. That’s why there are basically 0 preventive measures for detecting bad actors and preventing malicious attacks.

I can think of some solutions:

1. If a package is orphaned then let a potential maintainer just fork it and flag the original for deletion. So the user who has actually installed the old package and want an update will manually go out looking for the updated one instead of just doing a yay -Syu one day and getting malware on the system.
2. If the developer and maintainer are the same for an AUR package, let them maybe add a ArchWiki style captcha, whose output can be added to the upstream repo like in .aurverification file, which can be detected by AUR when putting in the upstream repo URL and the maintainer must verify with that captcha every 6 months or so just to prove active development. If they fail to do so, mark the package as abandoned or unverfied.
3. Newly created accounts will have a cooldown of a week to add a new package to the AUR (I don’t know if this exists already as I haven’t looked into it). And they can only create one repo in a month until a year has passed. They can takeover or fork orphaned packages only after a year and if they are maintaining at-least one repo of their own.

Maybe maintenance of packages shouldn’t just be handed over to newly created accounts. This is a design flaw on AUR’s part. As Linux popularity rises, these types of attacks will just keep growing. There should also be some sort of system where it is easy to verify that the maintainer of the package is also the actual developer. Like brave-bin has brave has the maintainer who are also the creator. Just give a green check mark to them or something.

I use it for pretty basic tasks. Like fixing capitalisation, some linux command flags that I can’t remember, news article summarisation and shit. For that it’s pretty good. If you have higher parameter model then you will get better results with it for complex questions but you need to have a beast of a GPU with at-least 12GB VRAM and at the bare minimum 32 Gigs of RAM. My setup can run 8B parameter models pretty fine.

I think GPT-OSS is a pretty good model — got good results with it for complex questions but it is heavy on my machine so I just use llama and gemma.

Well it is arriving in 2 days. I applied the catcuppcin (I hope I spelled that right) mocha theme which is slightly darker than gruvbox. Enjoying it so far. Just have to look for ultrawide oled wallpapers to go with that theme.

I don’t use ChatGPT but I have my ollama-openwebui instance with gemma.

It’s a fastfetch thing.

Edit: It’s this command birth_install=$(stat -c %W /); current=$(date +%s); time_progression=$((current - birth_install)); days_difference=$((time_progression / 86400)); echo $days_difference days

Nowhere is this more visible outside Palestine than in India, where 200 million Muslims are being pushed to the edge of extermination by the RSS-BJP regime. Under Narendra Modi, Islamophobia has been weaponised not as fringe hate but as state ideology.

I can’t speak for other parts of the world but I can for the Indian subcontinent.

I’m an atheist, and personally, I try not to judge anyone based on their religion — it generally works well, especially with upper and upper middle class communities. From my experience, upper class Muslims are usually integrated into society and not involved in shady activities.

I also don’t agree with government policies that discriminate against people based on religion like requiring proof of ancestry after Independence because such policies are unjust and target citizens unfairly.

That said, I do have concerns about certain practices in some lower income communities in India. Poverty, limited education and social isolation can make people more vulnerable to radical messaging. Madrasas (which btw are even attended by children younger than teenagers) teach extreme ideas, like framing conversion as a duty or promoting a black and white worldview. In rare cases, this can lead some individuals to embrace jihadist ideology or commit illegal acts in the name of religion. Social media can further amplify these messages. While most Muslims are peaceful, certain forms of radicalisation especially among vulnerable Islamic populations can be more organised and aggressive compared to similar movements in other major religions.

So even the propaganda by our right wing government is exaggerated, it does have some truth to it. It can be solved by eliminating all religious education in pre-teen ages and criminalising parents for forcing that type of education on children.