I'm not entirely sure what you mean by "part of operating system, separate from the app stores", but in this case a server was delivering tainted updates, so having an OS-based update mechanism/package manager by itself wouldn't have prevented this. Unless you also mean that this update should have gone through the OS's repositories (which I feel is close to app store).

A quick search showed compromised packages in arch aur repos: https://www.bleepingcomputer.com/news/security/malware-found...

You only change the focal point, but a centralised package manager is good for reasons other than security. Sure, a central tool will keep your whole system updated and improve security overall, but it won't prevent supply-chain attacks from happening.

Reading mailing lists and being careful with what you install will take you a long way in preventing malware.

I trust packages that comes from official repositories.

> Warning: AUR packages are user produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

In other words AUR is not much safer than `curl to | sh`.

I assume AUR includes hashes, which could at least hint to deterministic builds. `curl to | sh` can change from build to build and there's no way to find out from which source other users built.

Sure, but it is centralised in the os distribution package manager, if you use helpers like yay. I am just pointing out that centralisation is not solution to the attack mentioned.

This is one of the biggest advantages of linux.

The repos are basically an App Store. The only advantage is you can add multiple repo sources.

Kinda like f-droid

Security by obscurity?

https://www.bleepingcomputer.com/news/security/malware-found...

Imagine how many more attacks there would be if Linux was much more popular.

The AUR isn't officially supported by Arch, it's just a collection of community scripts. In fact "AUR helpers" aren't present in Arch repos.

Anyone can upload stuff to the AUR, so it's only to be expected that there's some malware there. At the very top of the wiki page for the AUR[0], it warns:

> Warning: AUR packages are user produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

If you want to stay malware-free and aren't able to vet the packages you're installing, just stick to the official repositories and you'll be fine. This page[1] documents the role of each official repository, and this page[2] is a list of the people who can modify the official community repository.

[0]: https://wiki.archlinux.org/index.php/Arch_User_Repository

[1]: https://wiki.archlinux.org/index.php/Official_repositories

[2]: https://archlinux.org/people/trusted-users/

It is only used in ~80% of some of the most valuable targets on the internet, the servers, and it is only by far the most used operating system with more than 50% compared to the huge target that is the ~15% that is Windows. Security by obscurity is more fitting for Windows than Linux. Imagine how many more attacks there would be if Windows was much more popular. Windows in on par with iOS. Stop being a troll.

https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...

>it is only by far the most used operating system with more than 50%

So you're counting Android as Linux, that means Linux has a big malware problem right? Or do you only count Android to pad Linux's numbers and then discount Android malware?

Servers are managed by relatively much more tech savvy folks who install programs carefully. Not so much on PCs that aren't locked down like iOS, and where there is developer freedom.

iOS is only more secure than Windows at the cost of developer freedom, sad to see people on a techie site praise iOS and insult Windows based on that.

It is, but then you come to places like HN and everyone is bashing against App Stores.

The problem lies in Unix/Windows style app packaging, or lack thereof in Unix as originally conceived. /etc, /usr, and so on.