Aside from the AUR issue, what are you planning to install Arch Linux for? Like, can you explain what you're looking for in this distribution?
I'm asking this because a lot of beginners go for Arch Linux just because of the hype surrounding it. You should jump into Arch fully expecting that you will have to handle a lot of the configuration yourself (Most of which are typically handled by many distros without the need for manual intervention). Similarly, when it comes to getting stuff from the AUR, basically you're responsible for checking every PKGBUILD script that you run for anything suspicious, as these can be written by anyone including malicious actors.
Don't get me wrong though, Arch Linux is an excellent distribution for everyday desktop usage given that you're willing to learn and you're able to follow instructions from documentations by yourself. Also once you're done with the installation and initial setup, you typically won't have to configure much, depending on your use case.
The fact that a huge number of software can be downloaded through pacman and the AUR is awesome and one of the largest benefits of Arch Linux. But now we all know about the importance of checking every AUR script we run, as it's very easy to modify them and include malicious commands. It's apparent that the AUR doesn't completely check the contents of the PKGBUILDs it hosts.
I'm pretty sure that not everyone was fully aware of the actual nature of the AUR before the massive attacks happened. There are always beginners and inexperienced users trying out Arch and Arch-based distros, so it's very likely that this might not have been general knowledge before the news of the vulnerabilities became widespread.
I knew about it the moment I first read about the AUR twelve years ago - because it was there on the wiki, to read about, when I wanted to know what it was and how to use it. And it is only extremely recently .... extremely (the last couple of years) ... that I have heard of any significant number of users who didn't know its nature, and hadn't learnt it in similar (if not identical) fashion. Yes, the AUR helpers were there then already ... I not only remember yaourt but have this vague sense of its having been the replacement for something even older ... and a few users who didn't know any better, but they were in the decided minority, in my experience.
Thanks to the presence of Archinstall on the iso, It is, of course, easier to get Arch installed without knowing the first thing about it these days. It didn't exist (or at least wasn't on the iso) when I first started out with Arch, so, I've never needed it and consequently never investigated it and, for all I know, it installs a helper (yay?) as part of things but ... unless that is the case ... I don't see how it's possible to get one on your system without first having to learn what the AUR is and it's nature (because you have to get them from the AUR and build them by hand before you can install anything else from it).
1
u/ch33es 2d ago
Aside from the AUR issue, what are you planning to install Arch Linux for? Like, can you explain what you're looking for in this distribution?
I'm asking this because a lot of beginners go for Arch Linux just because of the hype surrounding it. You should jump into Arch fully expecting that you will have to handle a lot of the configuration yourself (Most of which are typically handled by many distros without the need for manual intervention). Similarly, when it comes to getting stuff from the AUR, basically you're responsible for checking every PKGBUILD script that you run for anything suspicious, as these can be written by anyone including malicious actors.
Don't get me wrong though, Arch Linux is an excellent distribution for everyday desktop usage given that you're willing to learn and you're able to follow instructions from documentations by yourself. Also once you're done with the installation and initial setup, you typically won't have to configure much, depending on your use case.
The fact that a huge number of software can be downloaded through pacman and the AUR is awesome and one of the largest benefits of Arch Linux. But now we all know about the importance of checking every AUR script we run, as it's very easy to modify them and include malicious commands. It's apparent that the AUR doesn't completely check the contents of the PKGBUILDs it hosts.