TechPulseTechPulse
Back to News
Advertisement
Advertisement

⚡ Community Insights

Discussion Sentiment

67% Positive

Analyzed from 227 words in the discussion.

Trending Topics

#package#adoption#orphaned#packages#sure#legitimate#foo#don#longer#seems

Discussion (4 Comments)Read Original on HackerNews

Sleaker•about 1 hour ago
I don't think any form of automated adoption of orphaned packages will ever work, it's just too easy to introduce malicious code into an otherwise functional but no longer maintained source.
delecti•about 1 hour ago
That title had me worried, but the reality seems quite reasonable.

I assumed the goal was to reduce usage of AUR, they've actually remove the ability to adopt (take ownership of) orphaned packages. I'm sure there are legitimate uses of that functionality, but it also seems like a pretty big avenue for abuse.

bee_rider•1 minute ago
IMO allowing package adoption makes sense in the responsible/intended use-case: AUR packages aren’t trusted, you have to read the PKGBUILD anyway, so the reputation of the contributor doesn’t matter. Removing adoption is admitting that there’s no way to prevent some users from blindly trusting a PKGBUILD.

Which is probably the best choice, unfortunately.

jolmg•12 minutes ago
> I'm sure there are legitimate uses of that functionality

To avoid package name pollution, e.g. having package foo, foo-newpackage, foo-newpackage-updated, etc. each by a new maintainer as the priors get abandoned.

OJFord•about 1 hour ago
I've used it (not for abuse). It's simply volunteering to maintain the package after previous maintainer(s) have explicitly disowned it, knowing they no longer have time for it or don't care because they stopped using it, etc.
gchamonlive•43 minutes ago
Problem is that there is no KYC process before someone can adopt any orphaned package
ameliaquining•about 1 hour ago
Yeah, the security problems with unilateral adoption of orphaned packages by unprivileged users are fundamental and unfixable; the only remedy is to remove the feature. Whether it has legitimate use cases (which it sounds like it does) is irrelevant. I'm not sure why it took them so long to realize this and act accordingly, but I'm glad they now have.