[dwedge]

> No, I'm sorry but who on earth installs random software from random strangers

Everyone. People who don't tend to build from source and the convenience of package managers has outweighed this for most people for years now. Even if you review the code do you review every library it pulls in? Because I have to tell you I don't believe you, and if most people did do that then these supply chain attacks would be minor news.

[embedding-shape]

I can tell you misunderstand what the AUR actually is. It's not a package registry maintained by anyone, and it's also not limited to "build from source" or whatever. It's more like npm if anything, if you're familiar with that distribution mechanism.

[matheusmoreira]

> It's more like npm if anything, if you're familiar with that distribution mechanism.

True, but I'd reverse the order. It's npm, pip, cargo, gem and all the others that are like the AUR. They're every bit as dangerous as the AUR, yet the AUR is the only one that singles itself out by warning people of the danger.

Anyone can sign up and push packages. I've literally done that myself, even though nobody in the Arch Linux community knows or trusts me. AUR is the only one where users are repeatedly made aware of this danger. All the others normalize and encourage importing random unvetted dependencies for the sake of developer convenience.

[preg_match]

Yes, and this is why npm is never installed on my hosts.

Folks podman is good. Very, very good. You want good developer ergonomics? Use dev containers. The cost of pulling npm packages Willy nilly on the host is not worth it!

[matheusmoreira]

> podman

Potential malware will share a kernel with the host. One exploit and we're owned. Virtual machines are the better solution. Infinitely smaller attack surface. If they crack hardware hypervisors, it means the entire industry is in deep shit, not just us.

I went so far as to code up my own development virtual machine orchestration software. Now I'm making a custom Rust network stack for it.

[dwedge]

I misunderstood your comment more and in that case I apologise. I thought you meant you review all packages you install or upgrade from any source.

In my case I'm guilty of not checking brew updates (even from casks) on Mac, but I'm also guilty of only updating them every couple of months so it probably balances out.