Skip to content

Comment on AURpocalypse now: a look at the recent AUR attacksparent

Comments

Yes, the only reason this isn't happening in other distros is simply popularity.

Namespacing is the solution, and as mentioned in the article some ditros do indeed have namespaced user repos, like Fedora's Copr. The trust model of a flat namespace user repo is completely broken when the maintaining user can change at any moment.

Isn't Arch's AUR flat namespace quite unique? Ubuntu's PPAs are also not flat.

openSUSE's OBS and Gentoo's overlays aren't a single shared repo either.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.