News for hackers. Stuff that matters.

A comment on Linux Mint Dumps Ubuntu Snap. Parent comment

Re:Linux Mint Dumps Ubuntu Snap by Sevaris on Friday June 05, 2020 @05:58PM (#23434515)
You're never forced to update. I'm don't even think Arch natively supports automatic updates. You can also tell pacman to skip a package from being updated if you're aware of a problematic update but you want to update the rest of your system.

And yes, Arch takes in the upstream vanilla packages, though there are testing phases before updates reach stable repos. I'm not sure any of this is a bad thing. It also means you don't have to wait 6-12 months for the newest version.

[ Parent | on HN ]
Re:Linux Mint Dumps Ubuntu Snap by dathinab on Friday June 05, 2020 @06:24PM (#23434728)
I think what he/she means is that core maintainers (or AUR maintainers) might be able to change a package without another core maintainer (or AUR maintainer) reviewing it.
[ Parent | on HN ]
Re:Linux Mint Dumps Ubuntu Snap by Sevaris on Friday June 05, 2020 @06:28PM (#23434756)
Afaik, upstream packages aren't changed by Arch maintainers. It's the whole point of using Arch. And if you're using AUR, you'd better be checking the PKGBUILD (because no, it isn't verified by anybody). At the very least, you need to be checking where the package is being downloaded from.
[ Parent | on HN ]
Re:Linux Mint Dumps Ubuntu Snap by dathinab on Friday June 05, 2020 @06:59PM (#23434958)
The PKGBUILD of packages in the official repository can be changed, which people theoretically could use to inject malware. That's what I meant.
[ Parent | on HN ]