Drowning in Garbage: AUR Shows That Too Much Low-Quality Software (Including Slop) is Bad for Everybody
Last month: "Flathub, by the most popular (effectively only) repository for Flatpak applications, has changed its policies to include a strict ban on “AI” use for both application submissions as well as the application code itself."
At the beginning of this month KDE dumped AUR, citing "security" as the reason [1, 2]. About a week later it turned out that KDE had a point [1, 2] as "hundreds" of compromised packages turned out to be well over a thousand and after clean-up new users (including legitimate developers) were no longer able to upload/update packages. The project basically lost control, lost in a sea of garbage contributions and garbage contributors (bad actors).
What does that tell us about GNU/Linux? Wrong question. It can happen everywhere, even in WordPress.
The issue is poor auditing or lack of auditing. Imagine how much worse things would get if sloppers who say they "vibe-code" began uploading software and even expected volunteers to audit what they upload (i.e. review code that they themselves - the sloppers! - never even wrote). Flatpak has already expressed concerns to that effect.
"I have not followed the AUR case particularly closely," an associate has said. "Back in 2008 or 2009 when I looked at Arch, it was a non-starter because back then there was no means to cryptographically verify packages."
Even if one was to cryptographically verify these, how would one know if they're safe? The issue with malicious packages is that they are malicious, even if they are authentic.
It has long been said that the world would be better off with more software, but there is a bottleneck because verification of safety is a time-consuming task that must be done each time an update is applied (e.g. a package has a bugfix).
In the context of WordPress, all themes (and updates to them) had to be individually checked to ensure they didn't do anything malicious. It was a tedious job, sometimes (in the early days when I was personally involved) done by unpaid volunteers. Alex King used to do that around 2005. He found that fatiguing.
So to avoid doomsday scenarios one can stick to reputable, trustworthy packages with a good process of development behind them.
What happened in AUR had happened elsewhere before and will happen again in the future. █
Image source: Toy Garbage truck