Maragato

joined 2 years ago
[–] Maragato@lemmy.world 6 points 10 hours ago* (last edited 10 hours ago) (1 children)

Aur is probably the main reason why many people use Arch and derivatives. However, many users are unaware that aur is not an official Arch repository and that, as you say, you are the one who has to monitor the pkgbuilds of each installed aur package. Normally the most used aur packages tend to generate more confidence but that does not prevent that package to include malicious software in a version change and having root access to the system can take control of certain system services. That's why I always recommend not using Aur and that's why I've always found Manjaro to be a great distribution, as it retains packages for a few days to check them and discourages the use of aur. Any security measure is too little and that's why any security tool you can configure is advisable. In a rolling distribution where new code is constantly entering the system, it is essential to have selinux and secureboot enabled.

[–] Maragato@lemmy.world 2 points 10 months ago

The only AMD (A10-7700K) that has given me problems with wayland uses by default the old radeon driver. I switched to the amdgpu driver and everything was solved.

[–] Maragato@lemmy.world 1 points 1 year ago (1 children)

That is, you admit that most aur users delegate that function to other eyes instead of auditing the external code they are installing. A user repository outside of the official distribution repository is not a secure means of installing packages on the system, which may have root access to the system and the source code may change with each package update. Do you think that every time there is an update to a package that is not widely used, others will audit the source code for you? For that reason I stopped using Aur and by extension Arch, as their software catalog outside of aur is small.

[–] Maragato@lemmy.world 5 points 1 year ago* (last edited 1 year ago) (9 children)

Any major Linux distribution has a system for building packages, it's not something special to Arch. In fact, Arch's great advantage of the aur repository actually becomes a disadvantage by introducing instability and insecurity into your system when you add programs from that repository. It's amazing that people criticize Windows security with .exe's and then install packages from external repositories with the security of "trust in the repository". How can you trust code with root access to the system just because it's in the aur repository? That's the main question I would ask Arch users.

[–] Maragato@lemmy.world 52 points 1 year ago (6 children)

Most of the time it is achieved with the phrase: "I use Arch, btw". 😉

[–] Maragato@lemmy.world 38 points 1 year ago* (last edited 1 year ago) (4 children)

SUSE has its line of business in servers and cloud computing. Opensuse has desktop users as its main asset. Not wanting the company's name to appear on the distribution is because the typical users of the two are increasingly different, as well as suspecting that Leap will not continue as SLE's 1:1 solution. Suse's decision not to have its name on the distribution means that it will be increasingly distanced from the community distribution, which is primarily run by Suse employees, so it is the company's decisions that will shape the future of the distribution.
A company's decisions are based on the benefits of its line of business, not on the benefits of the community outside its customers. This is a statement of intent that in my opinion breaks the relationship of trust between company-community. It is time to look for another distribution, the chameleon has focused on its profits rather than on the benefits for the community.

 

I have always been afraid to install Arch because they tell you it is difficult to install and unstable. I want a simple system following the KISS philosophy and install only what I need, which is little. I don't need anything from the aur repository, for now. Just a year ago I installed Arch and there it is, no problems and doing every day pacman -Syu. It has been a real discovery for me, it's the only distribution I've had this last year that hasn't crashed. I didn't expect it, but Arch has made me change my opinion and pay less attention to the opinions of "youtubers" and more to my own experience. In your experience of use, has Arch been stable in its operation?

[–] Maragato@lemmy.world 16 points 1 year ago* (last edited 1 year ago)

You can install Firefox from Mozilla's own repository. It is a luxury to have in Debian a Mozilla repository to install Firefox.

[–] Maragato@lemmy.world 2 points 1 year ago

If you want full system control and a rolling distribution with a good security setup, stay with openSUSE Tumbleweed. Immutable distributions like SilverBlue, Aeon,...are not recommended for everyone, only for those who don't want to administer their system and who have good hardware and a good internet connection.

[–] Maragato@lemmy.world 1 points 1 year ago* (last edited 1 year ago)

My experience with Arch+Gnome has been problematic with Gnome version changes. When I upgraded to Gnome 46, the system wouldn't boot. I have had several problems related to grub and aur, so a few months ago I decided to abandon Arch for good. I need a distro that works for me, not me for the distro.

[–] Maragato@lemmy.world 3 points 1 year ago

Great news, but I would put more effort into making Anaconda a faster and more intuitive installer.

[–] Maragato@lemmy.world 3 points 1 year ago (1 children)

If you want to learn about Arch, I recommend you to use ArcoLinux, a distribution that uses the direct Arch repositories (unlike Manjaro) and serves to acquire knowledge about Arch.

view more: next ›