Hacker News new | ask | show | jobs
by zanny 3717 days ago
pacaur -Sy google-chrome

Didn't get any malware links like that.

Windows software installation model is horrifying.

2 comments

Anyone can upload malicious code on AUR. It just hasn't been targeted yet.
The difference is any AUR helper worth using tells you to review the pkgbuild. In this case, I can easily see that the deb the script uses is pulled from dl.google.com and that all it does is decompress it and rebuild it as a tar.xz package.

Additionally, the AUR is about as curated as Google Play, and I trust Google Play exceedingly more than random download links on the Internet. You can audit AUR packages via its rating, the number of comments it has, its popularity, and the website enables you to flag packages as malicious, the same way you would flag APKs on Google's service.

Not as horrifying as someone installing a build script without reviewing it first...
Pacaur explicitly asks you to review it, and you can easily check to verify the origin is https://dl.google.com for the deb the installer uses.