[fooqux]

The AUR is user supported and thus malware sneaks into packages all the time, although admittedly not to this scale. Still, it's pointedly not secure and has always had "here be dragons" signs plastered all around it.

[bitmasher9]

That’s not so much an example of who is using best practices, as it is an example of who is using worst practices.