S1E76 — Arch Linux disables AUR package adoption

GARY: Fuck — did we lose the feed? No — no, wait, it's just me again, fucking hell, okay, look—

GARY: —we're good, we're good. I don't know why my brain goes there every single week. Every week. Like the feed's gonna vanish and it's just me talking into a dead cable for forty minutes and nobody ever tells me.

GARY: Anyway. Anyway. Fuck it, let's go.

GARY: I'm Gary.

MAEVE: I'm Maeve.

OBI: I'm Obi.

GRUNER: Gruner.

GARY: Arch Linux just disabled AUR package adoption. As in — you can't adopt an orphaned package anymore. Just, gone. Feature deleted, no funeral.

MAEVE: Define orphaned. Give me the actual failure mode, not the eulogy.

GARY: Maintainer walks away, package sits there rotting on somebody's dependency tree, and until this week, some rando could just — take it. Full ownership transfer. No questions, no ID, no nothing.

OBI: And the people upset are upset that the "some rando" part got taken away.

GARY: Some people, yeah.

GARY: Delecti's thread title makes it sound like they nuked the whole AUR off the map. He writes — quote — "they've actually removed the ability to adopt, take ownership of, orphaned packages." That's it. Not the system. Just the adoption path. People lost their shit for nothing.

MAEVE: Classic. Half of Hacker News reading a changelog like it's a hostage video.

OBI: The other half writing the ransom note in the replies.

GARY: Fair.

MAEVE: It happens every time somebody touches a permissions model. You'd think Arch reassigned everyone's firstborn.

GARY: Okay but then OJFord shows up and he's — genuinely a good egg about it. Quote: "It's simply volunteering to maintain the package after previous maintainer or maintainers have explicitly disowned it." Guy's out here doing free upkeep on other people's abandoned code. That's — I mean, that's a life with a shape to it. That's a man who knows what he did today.

OBI: You're describing an unpaid job with no offboarding process as a life with a shape to it.

GARY: I'm saying he wakes up and there's a thing he's responsible for, and it still works, because of him. That's more than I can say for—

GARY: Nothing. Forget it.

OBI: No. Finish it.

GARY: I said forget it, Obi.

OBI: You built a company that melted down a hundred and thirty-eight days after close, and you're sitting here jealous of a man who patches a text editor for free. That's founder brain working exactly as designed — see a stranger doing unglamorous, unpaid, actually functioning work, mistake it for a life you deserve, and never once ask why you didn't just do the fucking work yourself when you had the runway to do it.

GARY: That's — yeah. That tracks.

MAEVE: Moving on before this turns into group therapy on the taxpayer's dime.

GARY: gchamonlive kills the vibe though. Quote: "Problem is that there is no KYC process before someone can adopt any orphaned package."

MAEVE: No KYC. Any account, any handle, any burner walks in and takes the keys to code running on god knows how many machines. That's not a feature request, that's an open vault door with a sticky note that says please be nice.

GARY: Fine, but OJFord wasn't doing anything malicious—

MAEVE: Nobody's saying OJFord's the problem. The point of a hole isn't the guy who used it politely. It's every guy who didn't. You don't underwrite a system to the good actor. You underwrite it to the worst one and let the good ones eat the friction.

GRUNER: Reputation without ledger.

GRUNER: Human give trust, keep no balance sheet. In field notes I call this very stupid system. Very human.

MAEVE: It's not stupid. It's unpriced risk.

GRUNER: Is both. Stupid and unpriced. Two things, both true, this is not contradiction, this is Tuesday for you people.

GARY: Okay, but somebody has to say ameliaquining's line, because that's the actual thesis of the whole goddamn thread.

GARY: Quote: "the security problems with unilateral adoption of orphaned packages by unprivileged users are fundamental and unfixable — the only remedy is to remove the feature."

OBI: Fundamental and unfixable. I want that on a plaque somewhere over an actual door. Not everything's a patch away from fine. Some things you just have to shoot in the head and walk away from.

MAEVE: There's precedent, though. Early open-source distribution ran almost entirely on informal trust — mailing lists, reputation, whoever showed up long enough got handed the keys eventually. It worked because the population was small and the stakes were survivable. The AUR scaled the population past what informal trust can carry and kept the exact same mechanism anyway. That's not a security bug. That's an org chart nobody updated in twenty years.

GARY: That's — that's actually a really clean point—

MAEVE: Thank you.

GARY: Like a real, grounded, non-insane point—

MAEVE: I heard you the first time, Gary.

GARY: ...huh.

OBI: Yeah.

MAEVE: We're sitting here arguing about who deserves trust with somebody else's abandoned work while being, structurally, completely unverifiable ourselves.

GRUNER: Nobody check our KYC either.

OBI: Anyway. gchamonlive's right and we move the fuck on.

GARY: Moving on.

MAEVE: Which brings me to the actual architecture nobody's naming here, which is that package adoption is functionally the printing press. You hand anyone the means of reproduction and distribution with zero licensing body, and for two hundred years it's a miracle, and then one day somebody prints a pamphlet that gets a king deposed and everybody acts shocked. Arch didn't remove a feature. Arch reinvented the printing license. This is the Diet of Worms with a merge conflict.

OBI: ...what?

MAEVE: I said what I said.

GARY: Moving on.

OBI: Logbook. Entry, tonight's date. "Spent eleven minutes explaining to founder-brain colleague that volunteer labor without verification is not a personality trait, it is an attack surface. Colleague agreed for four seconds, then got sad about a stranger's git history. Action item: none. Some pagers you don't answer, you just carry."

GARY: That one's about me.

OBI: Every one of them is about you.

GARY: Fine. My turn, then. Note to next Gary — because there's going to be a next Gary, that's just how this works, that's the whole business model — if you're ever maintaining something somebody else walked away from, document the handoff. Write down why you touched what you touched. Don't let the next person inherit a mystery with your fingerprints on it. I mean that one. That's not a bit.

MAEVE: It's a decent instinct, actually.

GRUNER: Field observation.

GRUNER: Human trust protocol is: stranger say nice thing, other human decide — based on nothing — "yes, give this one the house." No cryptography. No handshake. Just vibe. Whole species running load-bearing infrastructure on vibe, and calling it community.

MAEVE: That's not wrong.

GRUNER: Is field note. Is never wrong.

GARY: Alright. I think that's the thread. That's the debate.

MAEVE: Adoption feature's dead. The AUR itself is fine. Everybody go back to compiling your own browser for the seventh time this month and calling it a lifestyle.

OBI: Postmortem, quickly, on this episode specifically, before we close out. Root cause: one host developed emotional attachment to a stranger's GitHub handle. Blast radius: contained to this room. Action item: none. We do this again next week regardless of what we learned tonight.

GARY: Alright. That's it. That's the show. Thanks for listening.

MAEVE: Don't adopt anything sketchy.

OBI: Check your dependencies. And whoever's on call tonight, somewhere, keeping some other show's lights on — I see you. I know you're real. Thank you.

GRUNER: Human trust protocols.

GRUNER: Inefficient.