I think Bradley means that Apple should also be forced to open up their OS to other manufacturers?

Agree with “just cost of doing business” argument for Google. But market cap and fine amount ratio are totally unrelated. A company’s stock price can be highly inflated in trillions in market cap and yet can have negligible incoming cash like maybe a few million dollars. So a fine of billion would definitely hurt them a lot.

ok then i go to frontends. if that also shuts down, then bye bye reddit.

Winzip, i think, is owned by Corel I think. Almost as evil as Adobe. In India over here a lot of small businesses use it and it is unaffordable for them to get such creative suites. Corel constantly sends notices to the ones using cracked copies and force them to buy it for 3 years to avoid legal damages.

c/fuck_ai and c/fuckcars collab

Fine agree with all of what you say. But still the AUR is the only repo where this happens majority of the times. So what to do next? I am sure the solutions I mentioned in a comment below are not that difficult to implement.

And what do you need so many packages for?

Zen Browser, Elecwhat (Whatsapp – which is recommended in Arch Wiki), Razer peripherals drivers, heroic games launcher.

Without the AUR Arch becomes a third world country distro because the official repos have only the basics.

I am not talking about the code. I am talking there are basically zero security measures.

Edit:

Demanding to do more work from volunteers which already do a lot of work for free is rude. If you want something done - do it yourself

Then don’t make the platforms in the first place. This is such a stupid argument. It’s like someone creating a nuke but then ignoring the security measures and telling the rest of the people to take care of it. Genius. Should stop asking people to switch over to Linux as well then. Might as well I should just start bad mouthing and defaming Linux because users are left on their own by a hostile community.

That’s why we have warnings plastered all over.

Plastering warning labels everywhere is a cheap way to shift 100% of the accountability onto the user. Security should be built into the AUR’s design (throttling new accounts, forcing forks for orphaned takeovers or maintainer-developer verification), not outsource your job to the users as a reading assignment before every system update. Humans are the final layer of defense not the first.

Or maybe don’t use AUR blindly? You’re doing the equivalent of sudo curl — | bash… So only do it if you truly trust it.

There is a massive difference between blindly curling a random script from the open web and using a centralized, organized community repository. Yes AUR helpers are not recommended but they exist and are used by majority of Arch users and you can’t expect the user to know code and pkgbuilds especially when distros like CachyOS make it so damn easy to install the OS with AUR being just a checkbox away.

Just don’t run random code that you don’t understand

I don’t understand any code so does that mean I shouldn’t use any software? that is 99% of the world.

whole purpose of AUR, users can create and share packages with minimum fuss

This doesn’t take away responsibility away from the Arch team. I can manually review pkgbuilds all day trying to understand no problem but expecting the user to do it every update is stupid. At some point the user will just start to trust that package maintainer. I already mentioned few steps that the Arch team can take in a comment below.

I am gonna get a lot of hate for this but the AUR flaws are hidden behind a legal warning of “At your own risk”. They just don’t want to take the legal consequences for this. That’s why there are basically 0 preventive measures for detecting bad actors and preventing malicious attacks.

I can think of some solutions:

1. If a package is orphaned then let a potential maintainer just fork it and flag the original for deletion. So the user who has actually installed the old package and want an update will manually go out looking for the updated one instead of just doing a yay -Syu one day and getting malware on the system.
2. If the developer and maintainer are the same for an AUR package, let them maybe add a ArchWiki style captcha, whose output can be added to the upstream repo like in .aurverification file, which can be detected by AUR when putting in the upstream repo URL and the maintainer must verify with that captcha every 6 months or so just to prove active development. If they fail to do so, mark the package as abandoned or unverfied.
3. Newly created accounts will have a cooldown of a week to add a new package to the AUR (I don’t know if this exists already as I haven’t looked into it). And they can only create one repo in a month until a year has passed. They can takeover or fork orphaned packages only after a year and if they are maintaining at-least one repo of their own.

Yep an easy agree. Popular browsers like Zen, Helium and (god forbid) Brave should be directly in the official repos. So should be Jellyfin. It just makes sense given that debian repos have far more packages.

Maybe maintenance of packages shouldn’t just be handed over to newly created accounts. This is a design flaw on AUR’s part. As Linux popularity rises, these types of attacks will just keep growing. There should also be some sort of system where it is easy to verify that the maintainer of the package is also the actual developer. Like brave-bin has brave has the maintainer who are also the creator. Just give a green check mark to them or something.

You just proved my point. If a painter’s meticulous brushstrokes are so unique that they literally drive recurring revenue and make guests keep choosing that hotel, then that painter isn’t just a labourer anymore but a core value creator.

If their specific, artistic choices are generating perpetual, ongoing profit for the owner every year, then logically, they deserve a piece of that ongoing profit.

Similarly if the producer gets to make passive, recurring income off the crew’s recorded artistry forever, the crew deserves a piece of that recurring success. To argue otherwise is to say, Thank you for creating the magic that makes me rich. now go home while I collect the cheques.

That is a false equivalence.

A movie is not a hotel and the film crew is not following a fixed blueprint.

If a construction crew lays bricks perfectly, the hotel’s value stays the same (unless the architect actually makes a design that helps the property’s value to go up in which case they demand profit sharing and equity). But a film crew is creating a unique project. If the camera operator captures a breathtaking shot, the value of the movie skyrockets. if they mess up, it’s worthless. The crew’s creative labor is what actually generates the outsized profit.

Plus, we already give profit sharing to directors and writers because we acknowledge their labor creates the value. Arguing that the rest of the crew (who sacrifice their health and sleep to execute that vision) don’t deserve a slice isn’t logical.

Actually, if an architect and a construction team invented a revolutionary, hyper efficient, beautiful new way to build hotels that caused revenues to skyrocket gazillion %, they would demand royalties or equity. Furthermore, we already have a model for this: profit sharing, bonuses exist for above the line talent because we acknowledge their labour creates the outsized value. There’s no logical reason that shouldn’t extend to the rest of the crew who sacrifice their time and health to make it happen.

I hate how people frame as “Hey look the producers took the risk, so they should get the returns.” They just took a financial risk. It’s literally the easiest risk to take. Ask gamblers. While the crew takes all kinds of risk with the gear, dialogue choices, costume choices, set choices, sacrificing sleep and food for a day here and there, using the hours that they could have spent gambling in the stock market to come with a proper story, planning, practicing and executing it. So yeah these guys definitely deserve a bonus from the success as THEY MADE THE SUCCESS HAPPEN.

Absolutely but it is not easy. It needs to have several layers of abstraction by hiding what packages are being updated and auto approving themselves without prompting for password. There should be an automatic rollback mechanism in place in case an update goes bad. Some programs will need to auto-update themselves as users would expect like google chrome, firefox — which I don’t think we currently have other than steam. Otherwise if a person skips an update, they will leave their system vulnerable to the security bugs in browsers.

Only tech savvy people will actually install an OS. Unless you put a “Install OS” button on the keyboard most people will never switch. So they will probably never use Linux because the idea of switching defaults is scary because it is not “officially supported” by the manufacturer. Using the terminal is not a big deal. Most people can learn and adapt very easily, it’s not rocket science. The official defaults mindset is a barrier.

If we want Linux to grow, we need it to be installed by default on major hardware.

deserve an OS that is easier to use

Mint, Zorin, Ubuntu. They exist and have existed for a long time. They simply are not the default OS on any major piece of hardware.