this post was submitted on 14 Sep 2026
76 points (85.8% liked)

Linux

14972 readers
559 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 3 years ago
MODERATORS
 

Just an example, one of many. Check the upstream. Four months old. Two contributors: some human and an orange asshole. Human has no other repositories, so I guess the asshole is the more trustworthy one.

I'm assuming this is just some vibe coded bullshit where someone just said yes to everything Claude asked. I'd read the code to confirm it's not malicious but this person has already wasted enough of my time already.

Anyway AUR is not going to survive the Eternal Sloptober.

top 10 comments
sorted by: hot top controversial new old
[–] lemmysmash@piefed.social 45 points 1 day ago

Man, it's 2026. When you say "orange asshole", you have to clarify.

[–] moth@anarchist.nexus 14 points 23 hours ago (1 children)

this is the intended purpose of the AUR. it was never promised to be high quality or secure code, which is why there are warnings against using it if that is your concern. moth wonders why you complain about something you were told you must accept when using the AUR.

[–] sudo@programming.dev 4 points 20 hours ago

Its a common courtesy that if you publish something on the AUR, then you actually think people would use it and you plan to maintain it. You don't bother pushing some half baked afterthought to the AUR. Leave it on github. Otherwise you're just squatting a perfectly good AUR package name.

[–] frongt@lemmy.zip 64 points 1 day ago

AUR was never trustworthy. It leans very much towards the convenience end of the security-convenience spectrum.

[–] CameronDev@programming.dev 44 points 1 day ago (1 children)

This annoys me as well. And its not just AUR either, I hit this with pi.dev plugins, which are in NPM:

https://pi.dev/packages?name=permissions

Look how many duplicates there are, just because one person mildly changed am existing one, and never contributed back instead.

People are publishing their slop projects as if they intend on maintaining them, but they clearly aren't capable or willing to actually maintain them.

[–] sudo@programming.dev 8 points 23 hours ago

People are publishing their slop projects as if they intend on maintaining them, but they clearly aren’t capable or willing to actually maintain them.

This is my #1 problem with it. Just put it on github and call it a day. Don't act like its production ready at all. The #2 issue is namespace pollution.

[–] esc@piefed.social 21 points 1 day ago (2 children)

Why shouldn't they? They are using aur as intended, repository for user provided package recipes.

[–] communism@lemmy.ml 7 points 1 day ago

Sure, it's not against any rules, but it's at least rude to claim an AUR package name for some vibecoded app you spun up one afternoon and are not planning on maintaining. OP is just complaining about low quality software—"why not write low-quality software?", well sure, you are within your right to, but others are also within their rights to complain.

[–] Hamartiogonic@sopuli.xyz 12 points 1 day ago

Exactly. The way I see it, AUR is the Wild West where anything goes. There are good, bad and ugly packages so you better know what you’re doing when installing those.

[–] teawrecks@sopuli.xyz 6 points 1 day ago

The only thing on the AUR is a recipe to build the package on arch. In a perfect world, the AUR contains a build recipes for every package in existence. It's always up to the user to be discerning about what they install on their system.