On Sat, 2026-08-08 at 18:34 -0400, Jay Paul wrote: > Yeah, there’s a tool already that almost everyone already has, it’s > called your eyes and your brain. Reading the PKGBUILD is what you > should be doing.
You can’t fill a barrel with no bottom, no matter how much effort you put into it. In my opinion, an arms race is therefore the wrong approach either way. And since you can’t change human civilization in just a few years, the only real option left is what you’re suggesting. However, the more PKGBUILDs a single person has to inspect, the more likely it is that something will be overlooked, even if one were to understand everything perfectly, which is hardly possible with PKGBUILDs that use many patches. It will ultimately mean that a system highly customized by the user, with many packages originating from the AUR, will be less secure. Those who need more security will have to go with official repositories. They’ll then have to accept that they’ll have to choose, for example, from a somewhat more limited selection of web browsers. To return to the original analogy, once a barrel has a bottom, only a limited number of software packages will fit into it, perhaps only 50 web browsers instead of 1000. Or, to put it another way, anyone who needs more security will have to reduce their attack surface for the time being. So instead of more choices, the most realistic approach to solving the current problems will likely be to rely on fewer choices.
