{"slug": "aur", "name": "AUR", "category": "other", "category_name": "Other software", "description": "", "recommenders": 1, "commenters": 11, "warners": 8, "score": -6.041, "rising": -0.33, "first": "2026-02-20", "latest": "2026-08-30", "why": "The AUR, along with Arch's minimalism, is one of my favorite things about it.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 1, "neutral": 2, "compare": 0, "warn": 8}, "spark": [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0], "listed": false, "loved": [], "caveat": "", "short_quote": "The AUR, along with Arch's minimalism, is one of my favorite things about it.", "icon": false, "domain": "archlinux.org", "github_repo": null, "official_url": "https://archlinux.org", "pricing": "", "aliases": ["AUR"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 753564288, "item_id": 47097768, "url": "https://news.ycombinator.com/item?id=47097768", "by": "0x38B", "date": "2026-02-20", "stance": "recommend", "quote": "The AUR, along with Arch's minimalism, is one of my favorite things about it.", "excerpt": "How is that an unacceptable thread model for a repo of packages that are optional and user-made? One that clearly says, \"DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.\" (1) The AUR, along with Arch's minimalism, is one of my favorite things about it. Instead of cloning the source repo, reading the build instructions, building, and then installing, I download a s", "context": "Arch user who reads PKGBUILDs before install", "use_case": "installing user-made packages", "switched_from": "", "story": "How to Review an AUR Package"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 792052434, "item_id": 49503277, "url": "https://news.ycombinator.com/item?id=49503277", "by": "nickjj", "date": "2026-08-30", "stance": "warn", "quote": "I try very hard to avoid the AUR and only use it as a last resort", "excerpt": "Yep, but pretty much every single piece of software you've installed on your system can read and write files to your home directory in a silent way without root, and that's where your most important files are on a desktop machine (API tokens, secrets, client projects, etc.). I have my own opinionated Arch / niri set up and there's 1155 packages installed. That's 1155 opportunities for a package to be compromised. Thi", "context": "", "use_case": "", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 786356544, "item_id": 49147284, "url": "https://news.ycombinator.com/item?id=49147284", "by": "embedding-shape", "date": "2026-08-02", "stance": "warn", "quote": "essentially anyone, at any time, can become a \"mirror\" and host whatever code they want, with zero review.", "excerpt": "> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. Everything except that last part, are not \"random strangers on the internet\", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use \"mirrors\" hosted on their own infrastructure. AUR is a very different thing from this, where essentially a", "context": "", "use_case": "installing packages on Arch", "switched_from": "", "story": "Pushes to arch AUR are suspendended right now."}, {"id": 786290546, "item_id": 49143159, "url": "https://news.ycombinator.com/item?id=49143159", "by": "LargoLasskhyfv", "date": "2026-08-02", "stance": "warn", "quote": "It tends to get messy. So less AUR is less mess.", "excerpt": "There is much stuff which isn't in the AUR at all, or if so in versions similar to debian default, and/or orphaned. Nonetheless, the full tray is just one yay away, which also speaks git. How you use such tools is totally up to you. So far I've been unaffected by the AUR hickups, running Cachy for about 2 years now. But I've been always wary about the AUR, trying to minimize its use. Even in the phase where I used pu", "context": "", "use_case": "community packages", "switched_from": "", "story": "Arch Linux disables AUR package adoption"}, {"id": 779541379, "item_id": 48721336, "url": "https://news.ycombinator.com/item?id=48721336", "by": "keeganj", "date": "2026-06-29", "stance": "warn", "quote": "the model of using the AUR to install third party applications just seems broken", "excerpt": "Yeah I really enjoyed Cachy but the model of using the AUR to install third party applications just seems broken. I don't want to have to trust some random install script maintainer in addition to the 3p app developer. And sadly I don't have the time and attention to spare to review the AUR scripts of apps every time I update. I switched to Kubuntu to keep KDE (which I really found I enjoyed from Cachy) while using a", "context": "", "use_case": "installing third-party apps", "switched_from": "", "story": "CachyOS June 2026 Release"}]}], "who": [{"by": "zbentley", "context": "Arch daily driver for years", "url": "https://news.ycombinator.com/item?id=48605267", "date": "2026-06-19"}, {"by": "0x38B", "context": "Arch user who reads PKGBUILDs before install", "url": "https://news.ycombinator.com/item?id=47097768", "date": "2026-02-20"}], "tags": [], "use_cases": ["installing packages on arch", "community packages", "installing third-party apps", "user package repository", "arch user package repository", "arch packages"], "compared": [{"slug": "arch-linux", "name": "Arch Linux", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "pacman", "name": "pacman", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "cachyos", "name": "CachyOS", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "debian", "name": "Debian", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48600593", "title": "AURpocalypse now: a look at the recent AUR attacks", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=49499854", "title": "Omarchy: Any User Process Can Escalate to Root", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49146238", "title": "Pushes to arch AUR are suspendended right now.", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49123208", "title": "Arch Linux disables AUR package adoption", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48719361", "title": "CachyOS June 2026 Release", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48516379", "title": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {"recommend": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {"warn": 5, "neutral": 2}, "2026-07": {}, "2026-08": {"warn": 3}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 792052434, "item_id": 49503277, "url": "https://news.ycombinator.com/item?id=49503277", "by": "nickjj", "date": "2026-08-30", "stance": "warn", "quote": "I try very hard to avoid the AUR and only use it as a last resort", "excerpt": "Yep, but pretty much every single piece of software you've installed on your system can read and write files to your home directory in a silent way without root, and that's where your most important files are on a desktop machine (API tokens, secrets, client projects, etc.). I have my own opinionated Arch / niri set up and there's 1155 packages installed. That's 1155 opportunities for a package to be compromised. Thi", "context": "", "use_case": "", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 786356544, "item_id": 49147284, "url": "https://news.ycombinator.com/item?id=49147284", "by": "embedding-shape", "date": "2026-08-02", "stance": "warn", "quote": "essentially anyone, at any time, can become a \"mirror\" and host whatever code they want, with zero review.", "excerpt": "> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. Everything except that last part, are not \"random strangers on the internet\", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use \"mirrors\" hosted on their own infrastructure. AUR is a very different thing from this, where essentially a", "context": "", "use_case": "installing packages on Arch", "switched_from": "", "story": "Pushes to arch AUR are suspendended right now."}, {"id": 786290546, "item_id": 49143159, "url": "https://news.ycombinator.com/item?id=49143159", "by": "LargoLasskhyfv", "date": "2026-08-02", "stance": "warn", "quote": "It tends to get messy. So less AUR is less mess.", "excerpt": "There is much stuff which isn't in the AUR at all, or if so in versions similar to debian default, and/or orphaned. Nonetheless, the full tray is just one yay away, which also speaks git. How you use such tools is totally up to you. So far I've been unaffected by the AUR hickups, running Cachy for about 2 years now. But I've been always wary about the AUR, trying to minimize its use. Even in the phase where I used pu", "context": "", "use_case": "community packages", "switched_from": "", "story": "Arch Linux disables AUR package adoption"}, {"id": 779541379, "item_id": 48721336, "url": "https://news.ycombinator.com/item?id=48721336", "by": "keeganj", "date": "2026-06-29", "stance": "warn", "quote": "the model of using the AUR to install third party applications just seems broken", "excerpt": "Yeah I really enjoyed Cachy but the model of using the AUR to install third party applications just seems broken. I don't want to have to trust some random install script maintainer in addition to the 3p app developer. And sadly I don't have the time and attention to spare to review the AUR scripts of apps every time I update. I switched to Kubuntu to keep KDE (which I really found I enjoyed from Cachy) while using a", "context": "", "use_case": "installing third-party apps", "switched_from": "", "story": "CachyOS June 2026 Release"}, {"id": 777822961, "item_id": 48613935, "url": "https://news.ycombinator.com/item?id=48613935", "by": "jchw", "date": "2026-06-20", "stance": "warn", "quote": "its design and the way package maintainership works puts users at undue risk", "excerpt": "The issue with the AUR is that its design and the way package maintainership works puts users at undue risk compared to many other \"user\" repositories. This happens because so many useful packages are only available in the AUR to begin with, but also because the mechanism for taking over an orphaned package is just simply too open for exploitation. I don't have all the answers. I hope people will consider Nixpkgs as ", "context": "", "use_case": "user package repository", "switched_from": "", "story": "AURpocalypse now: a look at the recent AUR attacks"}, {"id": 777750513, "item_id": 48609407, "url": "https://news.ycombinator.com/item?id=48609407", "by": "einsteinx2", "date": "2026-06-20", "stance": "warn", "quote": "I would consider even the official Arch repositories to be dangerous", "excerpt": "That\u2019s a perspective on the AUR that I hadn\u2019t really seen before from Arch advocates, in my (admittedly hazy memory) it\u2019s usually mentioned in the sense of \u201cArch is great because you always get the latest packages in the official repos and basically anything you possibly need you can just install from the AUR\u201d. If you\u2019re actually using it just as a reference guide essentially then it seems like there\u2019s some value the", "context": "Debian Stable user", "use_case": "Arch user package repository", "switched_from": "", "story": "AURpocalypse now: a look at the recent AUR attacks"}, {"id": 777684274, "item_id": 48605267, "url": "https://news.ycombinator.com/item?id=48605267", "by": "zbentley", "date": "2026-06-19", "stance": "neutral", "quote": "The AUR is, as many others have pointed out, a deliberately un-vetted pile of random Git repos.", "excerpt": "The AUR is not the Arch package manager or repository. The main Arch package repos are managed similarly to Debian, or Fedora, or whatever--caveat Arch's nature as a rolling release, but in terms of vetting and ownership/security, the approaches are similar. pacman installs from regular, real, vetted repositories by default. pacman will never install from the AUR. pacman is the official Arch package manager and the o", "context": "Arch daily driver for years", "use_case": "", "switched_from": "", "story": "AURpocalypse now: a look at the recent AUR attacks"}, {"id": 777679633, "item_id": 48604977, "url": "https://news.ycombinator.com/item?id=48604977", "by": "akerl_", "date": "2026-06-19", "stance": "neutral", "quote": "But I treat the AUR for what it is: a place where anybody can say \"here's a PKGBUILD for folks\"", "excerpt": "It seems like you may have mistakenly inferred that I have issues with the AUR? I don't; I use Arch on 100% of my personal servers, have done so for something approaching 20 years, and don't see myself changing. But I treat the AUR for what it is: a place where anybody can say \"here's a PKGBUILD for folks\" and it's on me to evaluate it on its merits. I was legitimately asking the person upthread what other distro the", "context": "", "use_case": "", "switched_from": "", "story": "AURpocalypse now: a look at the recent AUR attacks"}, {"id": 776363072, "item_id": 48522692, "url": "https://news.ycombinator.com/item?id=48522692", "by": "Barrin92", "date": "2026-06-13", "stance": "warn", "quote": "I think that's a bonkers security model", "excerpt": ">But the AUR isn't Arch's main distribution model, and the official Arch repositories contain a ton of packages in the core, so not even the \"barebones core\" is correct here. I don't think that narrative is supported by the numbers. Arch's repositories are about a magnitude smaller than either the AUR or \"batteries included\" distributions like Debian. (about 10k to 100k packages), there are more people using Arch der", "context": "", "use_case": "", "switched_from": "", "story": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages"}, {"id": 776289472, "item_id": 48518092, "url": "https://news.ycombinator.com/item?id=48518092", "by": "Shellban", "date": "2026-06-13", "stance": "warn", "quote": "I should probably be rethinking how I use the AUR.", "excerpt": "Well, I seem to have been spared, purely because I have not turned on one of my laptops in a week. Like a few people here, I should probably be rethinking how I use the AUR.", "context": "", "use_case": "Arch packages", "switched_from": "", "story": "AUR Packages Compromised with Infostealer and Rootkit"}, {"id": 753564288, "item_id": 47097768, "url": "https://news.ycombinator.com/item?id=47097768", "by": "0x38B", "date": "2026-02-20", "stance": "recommend", "quote": "The AUR, along with Arch's minimalism, is one of my favorite things about it.", "excerpt": "How is that an unacceptable thread model for a repo of packages that are optional and user-made? One that clearly says, \"DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.\" (1) The AUR, along with Arch's minimalism, is one of my favorite things about it. Instead of cloning the source repo, reading the build instructions, building, and then installing, I download a s", "context": "Arch user who reads PKGBUILDs before install", "use_case": "installing user-made packages", "switched_from": "", "story": "How to Review an AUR Package"}]}