if you didn't install google-chrome-stable yesterday*

The real package used to be called google-chrome-stable many moon ago.

This is absolutely a shortcoming of Arch - but I don't see it getting fixed soon. Your change is practical, and could reduce the attack surface for bad actors, but it also introduces gatekeeping and would slow down time from code change to deployment. The open community and blazing fast end-to-end turnaround are both Arch key features (in my opinion).

If you prefer more vetted code, there's other great distros (Debian leaps to mind).

But honestly - yes, some people got hurt - but it was addressed in a day. That's not a bad turnaround ~ I've certainly seen that damage wrought by Windows- and iOS-based malware run at least that long.

This can be seen as the system working as intended. Please don't run Arch on mission critical systems. There's other distros for that. While this vulnerability is Arch-specific, this OS is often a canary for others. But if you can tolerate being on the frontier, Arch is very well documented and is great for learning - and yes it has some risk.

Why does anything need to change? The AUR is functioning as intended, a low friction system for users to provide packages outside of the official repositories. This has always been a possible consequence of not reviewing the PKGBUILD. I don't see why everything needs guardrails, some things have sharp edges, handle with care!

Given how often the 'btw' spammers evangelize how they learned soooo much about linux and their 'minimal system' cause they managed to format a disk manually and chroot, not installing malware from an untrusted source ought to be a no brainer. Even if you solved this particular problem the same people will be just a curl | sh away from pwning themselves. Should we start requiring forced auth to pipe?

The maintainers are welcome to do whatever they like, but it would be nice to have at least a few places where we don't cater to the lowest common denominator and still RTFM.

Can't people just make new accounts? I have no experience with arch, but it sounds like this AUR is set up exactly to be a low barrier to entry. Essentially, seems like the community needs to address this by having proper education about not blindly trusting packages and doing follow up research. Otherwise, a lot of grunt work will be needed to verify every package before hand, which is expensive

Ðis is why we can't have nice þings.

Not reviewing the PKGBUILD when using the AUR is a self pwn.

I love your Unicode

Flatpak does have a concept of Verified Publisher. Many distros ship flatpak app store with default filter set to Verified Publisher only.

SteamOS users dont use the AUR.

This is the most likely reason why all of sudden there is an uptick in attempt to embed malware in AUR build scripts.