[Matl]

With regards to sandboxing etc. maybe. With regards to packages? Official repos support signing and usually rely on maintainers with proven track records. AUR was a honor system and since some people are total basement losers, you can't rely on that.

[Alive-in-2025]

We have locks on our doors for a reason. Any software that allows updates and relies on the honor system of "someone else must have checked this" will get hacked. Every day there's yet another certificate or secret stealing infection that is in some random upstream dependency in your dev tools or shell scripts or whatever.

[thayne]

> Any software that allows updates and relies on the honor system of "someone else must have checked this"

That is never how the AUR was supposed to work. Updates were intended to be a manual process where the user reviewed changes to the PKGBUILD.

[Matl]

Yes, my point being this isn't some 'Desktop Linux security' hole. This was a known and intentional model of how the AUR operated for decades. Unfortunately it was bound to get exploited like this and so it did.