Hacker News new | ask | show | jobs
by johnisgood 331 days ago
yay is a package manager that has been made for AUR. yay is not the official package manager for Arch Linux, pacman is, and it does not support AUR. yay is not installed on Arch Linux by default, its official package manager, pacman, is. AUR is for unofficial 3rd party packages, i.e. "use at your own risk". It has always been the case.
1 comments
IlikeKitties 331 days ago
Yes, it is "use at your own risk" but most arch users just install from it without giving it a second thought, because availability of packages in the AUR is the one thing Arch is good at.
link
diggan 331 days ago
> most arch users just install from it without giving it a second thought

I'm not sure that's true. Neither I nor most people I know who use Arch (granted, most of them are professional software developers) install software from the internet willy-nilly and without reviewing anything, if by AUR or "curl | bash", especially when on their main computers.

link
johnisgood 331 days ago
N=1 but I rarely install from AUR and I have been using Arch Linux for decades. Using "yay" is akin to doing "curl | sh". You should inspect the PKGBUILD at the very least, and I do not believe "most users" is correct.
link
johnisgood 331 days ago
Oh, and by the way, not sure how people miss these:

> Warning: AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

This is from https://wiki.archlinux.org/title/Arch_User_Repository.

> Warning: AUR helpers are not supported by Arch Linux. You should become familiar with the manual build process in order to be prepared to troubleshoot problems.

This is from https://wiki.archlinux.org/title/AUR_helpers.

"yay" is one of the most common AUR helpers, it requires two confirmations from what I counted. One of them is to inspect the PKGBUILD file, the other one is just to proceed.

link
akerl_ 331 days ago
Those users are going to learn some hard lessons, either in this incident or a future one.

Archlinux is a distro that’s designed for the user to control their own system, and the AUR is clear about what it is and the nature of the packages in it.

link
homebrewer 331 days ago
It's also good at being fairly simple and transparent, and having the only sane package format in existence (along with Alpine's apkbuild which is basically the same thing), but okay.
link
Hackbraten 331 days ago
> most arch users just install from it without giving it a second thought

Citation needed.

link