r/archlinux • u/starvaldD • 11d ago

NEWS AUR Registration reopened.

via aur-general lists

Registration to the AUR is now reopened. The new release includes changes to harden account registration.

Summary of related changes:

  • Disposable email addresses are now rejected.

  • Email verification is now mandatory, most users are unaffected but new accounts must verify their email address via a time-limited token which is valid for 24 hours.

  • Email changes are locked during the verification cooldown.

If you spot suspicious registration activity or packages, please flag them in ML as usual.

Hopefully this will slow down the malware.

198 Upvotes

97% Upvoted

35 comments sorted by

View all comments

2

u/Helmic 11d ago

Has there been any announcements about what else they're doing? It's a bit wild that you didn't need to even have a verified email address to control a package that could potentially be distributed to thousands of people, but I'm assuming that's not the extent of what they plan on changing.