Supply Chain

For years, frontend engineering had a comforting boundary. The backend held the real power: databases, payments, authorization, infrastructure, production secrets. The frontend rendered the interface. It ran in the browser, where users could inspect it, modify it, and ultimately distrust it. That model still contains an important truth. The browser is not a trusted environment. A serious authorization decision cannot depend on what a client-side application chooses to show or hide. ...

If you fired up yay -Syu over the past week and noticed your AUR packages silently refusing to update, you’re not imagining it — and it isn’t a bug in your helper. As of August 1, 2026, Arch Linux disabled all pushes to the Arch User Repository, meaning maintainers could no longer publish updates, new versions, or fixes to the community package collection that most of us rely on daily. The AUR stayed up and readable, but writes were locked down while the project fought off its third supply-chain attack since June. ...