Rendered at 18:20:22 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
numeri 10 minutes ago [-]
Well, I guess I'll avoid updating for the next few days. A bit worrisome that I did so last night.
I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over.
LLMs make large scale and long-term attacks easy and cheap. You could (and if I was a three letter agency, I would probably do so!) maintain ten thousand packages as three thousand separate "individuals" for years before cashing in the trust you've built up.
embedding-shape 3 minutes ago [-]
> naively and gratefully trust in the armies of volunteer maintainers is over
I'm almost scared to ask, did you not even review the PKGBUILD or anything else before installing stuff from the AUR?
Nixpkgs has a completed different model compared to AUR, the changes that end up in nixpkgs are all reviewed by maintainers, while AUR is literally free-for-all "anyone can push anything at any time", I don't think you ever could "naively and gratefully trust" AUR in the way you might have been.
I wish I had a clear operating system to switch to for safety and the benefits that come with the AUR or the Nix ecosystem. Unfortunately it seems that the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over.
LLMs make large scale and long-term attacks easy and cheap. You could (and if I was a three letter agency, I would probably do so!) maintain ten thousand packages as three thousand separate "individuals" for years before cashing in the trust you've built up.
I'm almost scared to ask, did you not even review the PKGBUILD or anything else before installing stuff from the AUR?
Nixpkgs has a completed different model compared to AUR, the changes that end up in nixpkgs are all reviewed by maintainers, while AUR is literally free-for-all "anyone can push anything at any time", I don't think you ever could "naively and gratefully trust" AUR in the way you might have been.
Arch Linux disables AUR package adoption (https://news.ycombinator.com/item?id=49123208)