drankinatty
AUR isn't just some download site. It has been actively marketed by Arch for at least the 17 years I've used Arch as it's user repository. (that's kinda the acronym)
That creates the expectation, rightly or not, that the Arch User Repository provides some degree of protections for Arch Users against the build sources hosted there being compromised.
The AUR is a great resource for Arch and the wider Arch community and it was put together by some really talented folks at a time when the threat environment was completely different. Times have changed, and it's a sad testament for humanity.
AUR will get through this, and be better for the additional guardrails to be put in place, but blaming the victim and CYA never gets you there.
The issue the coding tools like Claude present is the sheer size and scope of changes and commits they generate that would take mere mortals months of careful coding to do.
That's an issue everyone using those tools will have to confront. I don't know Andrew personally, from a "let's go have a beer" standpoint, but I've known him from the samba list and his work with rsync for a very long time.
My take on the issue is less about the regressions and Claude screw-ups and more the lesson to all about the reliability of the coding tools and the diligence required to validate what they spit out.
It's an unfortunate black-eye, no doubt, but it's not a unique one. The takeaway is if something like this can slip by somebody like Andrew, then we all need to redouble the validation effort, lest we too are destined to share an unfortunate black-eye or two.
Never forget, "to err is human, but to really foul things up requires a computer."
AI just applies that adage at industrial-scale.
Exacerbating the matter is there is zero disclosure on Mozilla's part detailing exactly what information is sent to 3rd party servers as part of its AI rollout in FF 145. Would you risk your license on some FOMO AI rollout in FF that, unless you, as the lawyer or doctor, have stepped though each line of the tens of thousands of lines of FF code associated with this new AI to meet your ethical obligation and answer the bar or medical board's inquiry on whether client/patient information has been sent to a 3rd party?
Without the ability to completely disable and turn all AI submissions off, Mozilla's "Trust Us" position doesn't allow anyone with such a duty to meet it. This is before you even get to confidential and proprietary or trade-secret type information applicable in any professional setting.
These are all vexing questions from a legal standpoint.