it makes sense to me. remove as much friction from the publishing process as possible, so you get a huge amount of packages. this incident just shows they removed a little too much.
there are so many niche packages on the aur useful to so few people that nobody would go through the official process to properly package, test, and maintain them.
for example: vscodium is a fork of vscode, but microsoft disables the marketplace for it. the vscodium-marketplace package from the aur adds it anyway. i don’t think any regular repos have these kind of hacks and patches available.
I found it kinda funny that enabling the marketplace in VSCodium was your example here, given how much of a vector for malware that is itself. It’s malware all the way down.
You can download .vsix extensions from the marketplace and import them into VSCodium manually just FYI. And it won’t auto update so it will save you next time a supply chain attack inevitably hits and starts infecting new versions. Assuming the downloaded version isn’t infected in the first place of course.
It just seems odd to me if there is no maintenance why not just build a package yourself from the devs provided source code? Maybe I’m just an old man but it seems without the on going maintenance it would be about the same as for example using buildpackage and apt-build on Debian but that is a local repo for just me. So if something goes wrong it only affects me not the whole internet.
it makes sense to me. remove as much friction from the publishing process as possible, so you get a huge amount of packages. this incident just shows they removed a little too much.
there are so many niche packages on the aur useful to so few people that nobody would go through the official process to properly package, test, and maintain them.
for example: vscodium is a fork of vscode, but microsoft disables the marketplace for it. the
vscodium-marketplacepackage from the aur adds it anyway. i don’t think any regular repos have these kind of hacks and patches available.I found it kinda funny that enabling the marketplace in VSCodium was your example here, given how much of a vector for malware that is itself. It’s malware all the way down.
You can download .vsix extensions from the marketplace and import them into VSCodium manually just FYI. And it won’t auto update so it will save you next time a supply chain attack inevitably hits and starts infecting new versions. Assuming the downloaded version isn’t infected in the first place of course.
i don’t even use it, it was just the first thing on my mind. lots of packages have multiple versions with niche patches.
It just seems odd to me if there is no maintenance why not just build a package yourself from the devs provided source code? Maybe I’m just an old man but it seems without the on going maintenance it would be about the same as for example using buildpackage and apt-build on Debian but that is a local repo for just me. So if something goes wrong it only affects me not the whole internet.